878 lines
26 KiB
Plaintext
878 lines
26 KiB
Plaintext
|
|
# cargo-vet imports lock
|
|
|
|
[[audits.bytecode-alliance.audits.anyhow]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.62 -> 1.0.66"
|
|
notes = """
|
|
This update looks to be related to minor fixes and mostly integrating with a
|
|
nightly feature in the standard library for backtrace integration. No undue
|
|
`unsafe` is added and nothing unsurprising for the `anyhow` crate is happening
|
|
here.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.arrayvec]]
|
|
who = "Nick Fitzgerald <fitzgen@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.7.2"
|
|
notes = """
|
|
Well documented invariants, good assertions for those invariants in unsafe code,
|
|
and tested with MIRI to boot. LGTM.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.backtrace]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.3.66"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.block-buffer]]
|
|
who = "Benjamin Bouvier <public@benj.me>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.9.0 -> 0.10.2"
|
|
|
|
[[audits.bytecode-alliance.audits.bumpalo]]
|
|
who = "Nick Fitzgerald <fitzgen@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "3.9.1"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.bumpalo]]
|
|
who = "Nick Fitzgerald <fitzgen@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "3.11.1"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.cc]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.73"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.cfg-if]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.0"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.crypto-common]]
|
|
who = "Benjamin Bouvier <public@benj.me>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.3"
|
|
|
|
[[audits.bytecode-alliance.audits.digest]]
|
|
who = "Benjamin Bouvier <public@benj.me>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.9.0 -> 0.10.3"
|
|
|
|
[[audits.bytecode-alliance.audits.libm]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.2 -> 0.2.4"
|
|
notes = """
|
|
This diff primarily fixes a few issues with the `fma`-related functions,
|
|
but also contains some other minor fixes as well. Everything looks A-OK and
|
|
as expected.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.rustc-demangle]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.21"
|
|
notes = "I am the author of this crate."
|
|
|
|
[[audits.bytecode-alliance.audits.sha2]]
|
|
who = "Benjamin Bouvier <public@benj.me>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.9.9 -> 0.10.2"
|
|
notes = "This upgrade is mostly a code refactor, as far as I can tell. No new uses of unsafe nor any new ambient capabilities usage."
|
|
|
|
[[audits.bytecode-alliance.audits.spin]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-run"
|
|
version = "0.9.4"
|
|
notes = """
|
|
I've verified the contents of this crate and that while they contain `unsafe`
|
|
it's exclusively around implementing atomic primitive where some `unsafe` is to
|
|
be expected. Otherwise this crate does not unduly access ambient capabilities
|
|
and does what it says on the tin, providing spin-based synchronization
|
|
primitives.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.tinyvec]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.6.0"
|
|
notes = """
|
|
This crate, while it implements collections, does so without `std::*` APIs and
|
|
without `unsafe`. Skimming the crate everything looks reasonable and what one
|
|
would expect from idiomatic safe collections in Rust.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.tinyvec_macros]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.0"
|
|
notes = """
|
|
This is a trivial crate which only contains a singular macro definition which is
|
|
intended to multiplex across the internal representation of a tinyvec,
|
|
presumably. This trivially doesn't contain anything bad.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.unicode-normalization]]
|
|
who = "Alex Crichton <alex@alexcrichton.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.19"
|
|
notes = """
|
|
This crate contains one usage of `unsafe` which I have manually checked to see
|
|
it as correct. This crate's size comes in large part due to the generated
|
|
unicode tables that it contains. This crate is additionally widely used
|
|
throughout the ecosystem and skimming the crate shows no usage of `std::*` APIs
|
|
and nothing suspicious.
|
|
"""
|
|
|
|
[[audits.bytecode-alliance.audits.windows-sys]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_aarch64_gnullvm]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_aarch64_msvc]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_i686_gnu]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_i686_msvc]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_x86_64_gnu]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_x86_64_gnullvm]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.bytecode-alliance.audits.windows_x86_64_msvc]]
|
|
who = "Dan Gohman <dev@sunfishcode.online>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.42.0"
|
|
notes = "This is a Windows API bindings library maintained by Microsoft themselves."
|
|
|
|
[[audits.embark-studios.audits.anyhow]]
|
|
who = "Johan Andersson <opensource@embark-studios.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.58"
|
|
|
|
[[audits.embark-studios.audits.anyhow]]
|
|
who = "Johan Andersson <opensource@embark-studios.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.58 -> 1.0.66"
|
|
notes = "New unsafe usage, looks sane. Expert maintainer"
|
|
|
|
[[audits.embark-studios.audits.tinyvec_macros]]
|
|
who = "Johan Andersson <opensource@embark-studios.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.0"
|
|
notes = "Inspected it and is a tiny crate with single safe macro"
|
|
|
|
[[audits.firefox.audits.aho-corasick]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.7.18 -> 0.7.20"
|
|
|
|
[[audits.firefox.audits.anyhow]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.57 -> 1.0.61"
|
|
|
|
[[audits.firefox.audits.anyhow]]
|
|
who = "Bobby Holley <bobbyholley@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.58 -> 1.0.57"
|
|
notes = "No functional differences, just CI config and docs."
|
|
|
|
[[audits.firefox.audits.anyhow]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.61 -> 1.0.62"
|
|
|
|
[[audits.firefox.audits.anyhow]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.62 -> 1.0.68"
|
|
|
|
[[audits.firefox.audits.autocfg]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.1.0"
|
|
notes = "All code written or reviewed by Josh Stone."
|
|
|
|
[[audits.firefox.audits.block-buffer]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.10.2 -> 0.10.3"
|
|
|
|
[[audits.firefox.audits.bumpalo]]
|
|
who = "Bobby Holley <bobbyholley@gmail.com>"
|
|
criteria = "safe-to-run"
|
|
delta = "3.9.1 -> 3.10.0"
|
|
notes = """
|
|
Some nontrivial functional changes but certainly meets the no-malware bar of
|
|
safe-to-run. If we needed safe-to-deploy for this in m-c I'd ask Nick to re-
|
|
certify this version, but we don't, so this is fine for now.
|
|
"""
|
|
|
|
[[audits.firefox.audits.bytes]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.1.0 -> 1.2.1"
|
|
|
|
[[audits.firefox.audits.bytes]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.2.1 -> 1.3.0"
|
|
|
|
[[audits.firefox.audits.cpufeatures]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.2 -> 0.2.4"
|
|
|
|
[[audits.firefox.audits.cpufeatures]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.4 -> 0.2.5"
|
|
|
|
[[audits.firefox.audits.crossbeam-channel]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.5.4 -> 0.5.6"
|
|
|
|
[[audits.firefox.audits.crossbeam-deque]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.8.1 -> 0.8.2"
|
|
|
|
[[audits.firefox.audits.crossbeam-epoch]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.9.8 -> 0.9.10"
|
|
|
|
[[audits.firefox.audits.crossbeam-epoch]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.9.10 -> 0.9.13"
|
|
|
|
[[audits.firefox.audits.crossbeam-utils]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.8.8 -> 0.8.11"
|
|
|
|
[[audits.firefox.audits.crossbeam-utils]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.8.11 -> 0.8.14"
|
|
|
|
[[audits.firefox.audits.crypto-common]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.3 -> 0.1.6"
|
|
|
|
[[audits.firefox.audits.digest]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.10.3 -> 0.10.6"
|
|
|
|
[[audits.firefox.audits.either]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.6.1 -> 1.7.0"
|
|
|
|
[[audits.firefox.audits.either]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.7.0 -> 1.8.0"
|
|
|
|
[[audits.firefox.audits.fnv]]
|
|
who = "Bobby Holley <bobbyholley@gmail.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.7"
|
|
notes = "Simple hasher implementation with no unsafe code."
|
|
|
|
[[audits.firefox.audits.futures-channel]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.21 -> 0.3.23"
|
|
|
|
[[audits.firefox.audits.futures-channel]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.23 -> 0.3.25"
|
|
|
|
[[audits.firefox.audits.futures-core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.21 -> 0.3.23"
|
|
|
|
[[audits.firefox.audits.futures-core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.23 -> 0.3.25"
|
|
|
|
[[audits.firefox.audits.futures-task]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.21 -> 0.3.23"
|
|
|
|
[[audits.firefox.audits.futures-task]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.23 -> 0.3.25"
|
|
|
|
[[audits.firefox.audits.futures-util]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.21 -> 0.3.23"
|
|
|
|
[[audits.firefox.audits.futures-util]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.3.23 -> 0.3.25"
|
|
|
|
[[audits.firefox.audits.generic-array]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.14.5 -> 0.14.6"
|
|
|
|
[[audits.firefox.audits.getrandom]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.6 -> 0.2.7"
|
|
|
|
[[audits.firefox.audits.getrandom]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.7 -> 0.2.8"
|
|
|
|
[[audits.firefox.audits.hashbrown]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.12.3"
|
|
notes = "This version is used in rust's libstd, so effectively we're already trusting it"
|
|
|
|
[[audits.firefox.audits.hex]]
|
|
who = "Simon Friedberger <simon@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.4.3"
|
|
|
|
[[audits.firefox.audits.httparse]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "1.7.1 -> 1.8.0"
|
|
|
|
[[audits.firefox.audits.hyper]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.14.19 -> 0.14.20"
|
|
|
|
[[audits.firefox.audits.hyper]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.14.20 -> 0.14.22"
|
|
|
|
[[audits.firefox.audits.hyper]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.14.22 -> 0.14.23"
|
|
|
|
[[audits.firefox.audits.indexmap]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.8.2 -> 1.9.1"
|
|
|
|
[[audits.firefox.audits.indexmap]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.9.1 -> 1.9.2"
|
|
|
|
[[audits.firefox.audits.itoa]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.2 -> 1.0.3"
|
|
|
|
[[audits.firefox.audits.itoa]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.3 -> 1.0.5"
|
|
|
|
[[audits.firefox.audits.libc]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.126 -> 0.2.132"
|
|
|
|
[[audits.firefox.audits.libc]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.132 -> 0.2.138"
|
|
|
|
[[audits.firefox.audits.libc]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.138 -> 0.2.139"
|
|
|
|
[[audits.firefox.audits.lock_api]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.7 -> 0.4.9"
|
|
|
|
[[audits.firefox.audits.log]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.4.17"
|
|
|
|
[[audits.firefox.audits.memoffset]]
|
|
who = "Gabriele Svelto <gsvelto@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.6.5 -> 0.7.1"
|
|
|
|
[[audits.firefox.audits.miniz_oxide]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.5.3 -> 0.6.2"
|
|
|
|
[[audits.firefox.audits.nix]]
|
|
who = "Gabriele Svelto <gsvelto@mozilla.com>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.15.0 -> 0.25.0"
|
|
notes = "Plenty of new bindings but also several important bug fixes (including buffer overflows). New unsafe sections are restricted to wrappers and are no more dangerous than calling the C functions."
|
|
|
|
[[audits.firefox.audits.nix]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.25.0 -> 0.25.1"
|
|
|
|
[[audits.firefox.audits.num-bigint]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.6"
|
|
notes = "All code written or reviewed by Josh Stone."
|
|
|
|
[[audits.firefox.audits.num-bigint]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.4.3"
|
|
notes = "All code written or reviewed by Josh Stone."
|
|
|
|
[[audits.firefox.audits.num-integer]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.1.45"
|
|
notes = "All code written or reviewed by Josh Stone."
|
|
|
|
[[audits.firefox.audits.num-traits]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.2.15"
|
|
notes = "All code written or reviewed by Josh Stone."
|
|
|
|
[[audits.firefox.audits.num_cpus]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.13.1 -> 1.14.0"
|
|
|
|
[[audits.firefox.audits.object]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.28.4 -> 0.30.0"
|
|
|
|
[[audits.firefox.audits.once_cell]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.12.0 -> 1.13.1"
|
|
|
|
[[audits.firefox.audits.once_cell]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.13.1 -> 1.16.0"
|
|
|
|
[[audits.firefox.audits.parking_lot_core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.8.5 -> 0.8.6"
|
|
|
|
[[audits.firefox.audits.ppv-lite86]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.16 -> 0.2.17"
|
|
|
|
[[audits.firefox.audits.proc-macro2]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.39"
|
|
notes = """
|
|
`proc-macro2` acts as either a thin(-ish) wrapper around the std-provided
|
|
`proc_macro` crate, or as a fallback implementation of the crate, depending on
|
|
where it is used.
|
|
|
|
If using this crate on older versions of rustc (1.56 and earlier), it will
|
|
temporarily replace the panic handler while initializing in order to detect if
|
|
it is running within a `proc_macro`, which could lead to surprising behaviour.
|
|
This should not be an issue for more recent compiler versions, which support
|
|
`proc_macro::is_available()`.
|
|
|
|
The `proc-macro2` crate's fallback behaviour is not identical to the complex
|
|
behaviour of the rustc compiler (e.g. it does not perform unicode normalization
|
|
for identifiers), however it behaves well enough for its intended use-case
|
|
(tests and scripts processing rust code).
|
|
|
|
`proc-macro2` does not use unsafe code, however exposes one `unsafe` API to
|
|
allow bypassing checks in the fallback implementation when constructing
|
|
`Literal` using `from_str_unchecked`. This was intended to only be used by the
|
|
`quote!` macro, however it has been removed
|
|
(https://github.com/dtolnay/quote/commit/f621fe64a8a501cae8e95ebd6848e637bbc79078),
|
|
and is likely completely unused. Even when used, this API shouldn't be able to
|
|
cause unsoundness.
|
|
"""
|
|
|
|
[[audits.firefox.audits.proc-macro2]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.39 -> 1.0.43"
|
|
|
|
[[audits.firefox.audits.proc-macro2]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.43 -> 1.0.49"
|
|
|
|
[[audits.firefox.audits.quote]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.0.18"
|
|
notes = """
|
|
`quote` is a utility crate used by proc-macros to generate TokenStreams
|
|
conveniently from source code. The bulk of the logic is some complex
|
|
interlocking `macro_rules!` macros which are used to parse and build the
|
|
`TokenStream` within the proc-macro.
|
|
|
|
This crate contains no unsafe code, and the internal logic, while difficult to
|
|
read, is generally straightforward. I have audited the the quote macros, ident
|
|
formatter, and runtime logic.
|
|
"""
|
|
|
|
[[audits.firefox.audits.quote]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.18 -> 1.0.21"
|
|
|
|
[[audits.firefox.audits.quote]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.21 -> 1.0.23"
|
|
|
|
[[audits.firefox.audits.radium]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.5.3"
|
|
notes = """
|
|
I am no longer the primary maintainer of `radium`, however I have audited the
|
|
code to ensure it is still correct. The implementation contains no `unsafe`
|
|
logic, and will not abstract away `Sync` trait bounds.
|
|
|
|
The core logic is very simple, and acts as an abstraction trait for `Cell<T>`
|
|
and `AtomicT`.
|
|
"""
|
|
|
|
[[audits.firefox.audits.rand_core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.6.3 -> 0.6.4"
|
|
|
|
[[audits.firefox.audits.rayon]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.5.3"
|
|
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
|
|
|
|
[[audits.firefox.audits.rayon]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.5.3 -> 1.6.1"
|
|
|
|
[[audits.firefox.audits.rayon-core]]
|
|
who = "Josh Stone <jistone@redhat.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "1.9.3"
|
|
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
|
|
|
|
[[audits.firefox.audits.rayon-core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.9.3 -> 1.10.1"
|
|
|
|
[[audits.firefox.audits.redox_syscall]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.13 -> 0.2.16"
|
|
|
|
[[audits.firefox.audits.regex]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.5.6 -> 1.6.0"
|
|
|
|
[[audits.firefox.audits.regex]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.6.0 -> 1.7.0"
|
|
|
|
[[audits.firefox.audits.regex-syntax]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.6.26 -> 0.6.27"
|
|
|
|
[[audits.firefox.audits.regex-syntax]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.6.27 -> 0.6.28"
|
|
|
|
[[audits.firefox.audits.ryu]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.10 -> 1.0.11"
|
|
|
|
[[audits.firefox.audits.ryu]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.11 -> 1.0.12"
|
|
|
|
[[audits.firefox.audits.serde]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.137 -> 1.0.143"
|
|
|
|
[[audits.firefox.audits.serde]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.143 -> 1.0.144"
|
|
|
|
[[audits.firefox.audits.serde]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.144 -> 1.0.151"
|
|
|
|
[[audits.firefox.audits.serde]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.151 -> 1.0.152"
|
|
|
|
[[audits.firefox.audits.serde_derive]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.137 -> 1.0.143"
|
|
|
|
[[audits.firefox.audits.serde_derive]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.143 -> 1.0.144"
|
|
|
|
[[audits.firefox.audits.serde_derive]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.144 -> 1.0.151"
|
|
|
|
[[audits.firefox.audits.serde_derive]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.151 -> 1.0.152"
|
|
|
|
[[audits.firefox.audits.serde_json]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.81 -> 1.0.83"
|
|
|
|
[[audits.firefox.audits.serde_json]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.83 -> 1.0.85"
|
|
|
|
[[audits.firefox.audits.serde_json]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.85 -> 1.0.91"
|
|
|
|
[[audits.firefox.audits.sha2]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.10.2 -> 0.10.6"
|
|
|
|
[[audits.firefox.audits.smallvec]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.8.0 -> 1.9.0"
|
|
|
|
[[audits.firefox.audits.smallvec]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.9.0 -> 1.10.0"
|
|
|
|
[[audits.firefox.audits.socket2]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.4.4 -> 0.4.7"
|
|
|
|
[[audits.firefox.audits.syn]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.96 -> 1.0.99"
|
|
|
|
[[audits.firefox.audits.syn]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.99 -> 1.0.107"
|
|
|
|
[[audits.firefox.audits.synstructure]]
|
|
who = "Nika Layzell <nika@thelayzells.com>"
|
|
criteria = "safe-to-deploy"
|
|
version = "0.12.6"
|
|
notes = """
|
|
I am the primary author of the `synstructure` crate, and its current
|
|
maintainer. The one use of `unsafe` is unnecessary, but documented and
|
|
harmless. It will be removed in the next version.
|
|
"""
|
|
|
|
[[audits.firefox.audits.thiserror]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.31 -> 1.0.32"
|
|
|
|
[[audits.firefox.audits.thiserror]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.32 -> 1.0.38"
|
|
|
|
[[audits.firefox.audits.thiserror-impl]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.31 -> 1.0.32"
|
|
|
|
[[audits.firefox.audits.thiserror-impl]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.32 -> 1.0.38"
|
|
|
|
[[audits.firefox.audits.time]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.44 -> 0.1.45"
|
|
|
|
[[audits.firefox.audits.time]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.3.9 -> 0.3.17"
|
|
|
|
[[audits.firefox.audits.time-macros]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.2.4 -> 0.2.6"
|
|
|
|
[[audits.firefox.audits.toml]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.5.9 -> 0.5.10"
|
|
|
|
[[audits.firefox.audits.tower-service]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.3.1 -> 0.3.2"
|
|
|
|
[[audits.firefox.audits.tracing]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.1.35 -> 0.1.36"
|
|
|
|
[[audits.firefox.audits.tracing]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.1.36 -> 0.1.37"
|
|
|
|
[[audits.firefox.audits.tracing-attributes]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.1.21 -> 0.1.22"
|
|
|
|
[[audits.firefox.audits.tracing-attributes]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.1.22 -> 0.1.23"
|
|
|
|
[[audits.firefox.audits.tracing-core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.1.27 -> 0.1.29"
|
|
|
|
[[audits.firefox.audits.tracing-core]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-run"
|
|
delta = "0.1.29 -> 0.1.30"
|
|
|
|
[[audits.firefox.audits.typenum]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.15.0 -> 1.16.0"
|
|
|
|
[[audits.firefox.audits.unicode-ident]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.0 -> 1.0.1"
|
|
|
|
[[audits.firefox.audits.unicode-ident]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.1 -> 1.0.3"
|
|
|
|
[[audits.firefox.audits.unicode-ident]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "1.0.3 -> 1.0.6"
|
|
|
|
[[audits.firefox.audits.unicode-normalization]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.19 -> 0.1.20"
|
|
notes = "I am the author of most of these changes upstream, and prepared the release myself, at which point I looked at the other changes since 0.1.19."
|
|
|
|
[[audits.firefox.audits.unicode-normalization]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.20 -> 0.1.21"
|
|
|
|
[[audits.firefox.audits.unicode-normalization]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.1.21 -> 0.1.22"
|
|
|
|
[[audits.firefox.audits.unicode-xid]]
|
|
who = "Mike Hommey <mh+mozilla@glandium.org>"
|
|
criteria = "safe-to-deploy"
|
|
delta = "0.2.3 -> 0.2.4"
|