From 482788affbd102e0997f4a9817ef44c71f523a48 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Wed, 5 Aug 2026 22:32:27 -0700 Subject: [PATCH] fix(security): ratatui 0.29 -> 0.30 removes the lru dependency (RUSTSEC-2026-0002) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RUSTSEC-2026-0002 — lru's `IterMut` violating Stacked Borrows, categorised memory-corruption, patched in >= 0.16.3. This repo resolved lru 0.12.5. The source is not one of ours, which is why refreshing locks never cleared it: ratatui 0.29.0 requires lru ^0.12.0 That caret cannot reach 0.16.3, so no `cargo update` anywhere downstream could escape it. ratatui 0.30 dropped the lru dependency outright — the crate has zero lru mentions in its manifest — so the fix removes the vulnerable code from the graph rather than upgrading it. Found by reading `cargo metadata`'s resolve graph rather than the lockfile. `cargo tree -i lru` printed nothing here, which looks like "not a dependency" and is not: lru was present in metadata with no host-target dependent, and only the resolve graph named ratatui as the requiring package. A lockfile-level scan says which vulnerable versions exist; it does not say who pinned them. Worth recording for the rest of the sweep: an earlier pass concluded `ewf` was the only crate declaring lru. That was measured by grepping OUR manifests only, so it missed every third-party declarer. ewf was A source, not THE source. Verified: 15 test suites pass, clippy and fmt clean, `cargo deny check advisories` ok, `cargo vet --locked` succeeds, and the resolved lru is 0.18.2. --- Cargo.lock | 922 ++++++++++++++++++++++++++++++++++--- crates/4n6query/Cargo.toml | 2 +- supply-chain/audits.toml | 30 ++ supply-chain/config.toml | 316 +++++++++++-- supply-chain/imports.lock | 420 ++++++++++++----- 5 files changed, 1476 insertions(+), 214 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index bcbded1..ae99060 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -73,6 +73,15 @@ version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" +[[package]] +name = "approx" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cab112f0a86d568ea0e627cc1d6be74a1e9cd55214684db5561995f6dad897c6" +dependencies = [ + "num-traits", +] + [[package]] name = "array-init" version = "2.1.0" @@ -94,6 +103,15 @@ dependencies = [ "wait-timeout", ] +[[package]] +name = "atomic" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340" +dependencies = [ + "bytemuck", +] + [[package]] name = "atomic-waker" version = "1.1.2" @@ -133,11 +151,32 @@ dependencies = [ "syn 1.0.109", ] +[[package]] +name = "bit-set" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1" +dependencies = [ + "bit-vec", +] + +[[package]] +name = "bit-vec" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb" + +[[package]] +name = "bitflags" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" + [[package]] name = "bitflags" -version = "2.11.1" +version = "2.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" +checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" [[package]] name = "block-buffer" @@ -166,16 +205,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb" [[package]] -name = "bytes" -version = "1.11.1" +name = "by_address" +version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33" +checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06" [[package]] -name = "cassowary" -version = "0.3.0" +name = "bytemuck" +version = "1.25.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df8670b8c7b9dae1793364eafadf7239c40d669904660c5960d74cfd80b46a53" +checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797" + +[[package]] +name = "bytes" +version = "1.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33" [[package]] name = "castaway" @@ -202,6 +247,12 @@ version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" +[[package]] +name = "cfg_aliases" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" + [[package]] name = "chrono" version = "0.4.45" @@ -260,9 +311,9 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570" [[package]] name = "compact_str" -version = "0.8.1" +version = "0.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b79c4069c6cad78e2e0cdfcbd26275770669fb39fd308a752dc110e83b9af32" +checksum = "9dfdd1c2274d9aa354115b09dc9a901d6c5576818cdf70d14cae2bdb47df00ab" dependencies = [ "castaway", "cfg-if", @@ -272,6 +323,15 @@ dependencies = [ "static_assertions", ] +[[package]] +name = "convert_case" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9" +dependencies = [ + "unicode-segmentation", +] + [[package]] name = "core-foundation" version = "0.9.4" @@ -307,13 +367,19 @@ dependencies = [ "libc", ] +[[package]] +name = "critical-section" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" + [[package]] name = "crossterm" version = "0.28.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6" dependencies = [ - "bitflags", + "bitflags 2.13.1", "crossterm_winapi", "mio", "parking_lot", @@ -323,6 +389,24 @@ dependencies = [ "winapi", ] +[[package]] +name = "crossterm" +version = "0.29.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b" +dependencies = [ + "bitflags 2.13.1", + "crossterm_winapi", + "derive_more", + "document-features", + "mio", + "parking_lot", + "rustix 1.1.4", + "signal-hook", + "signal-hook-mio", + "winapi", +] + [[package]] name = "crossterm_winapi" version = "0.9.1" @@ -342,6 +426,16 @@ dependencies = [ "typenum", ] +[[package]] +name = "csscolorparser" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eb2a7d3066da2de787b7f032c736763eb7ae5d355f81a68bab2675a96008b0bf" +dependencies = [ + "lab", + "phf", +] + [[package]] name = "darling" version = "0.23.0" @@ -376,6 +470,40 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "deltae" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4" + +[[package]] +name = "deranged" +version = "0.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" + +[[package]] +name = "derive_more" +version = "2.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134" +dependencies = [ + "derive_more-impl", +] + +[[package]] +name = "derive_more-impl" +version = "2.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb" +dependencies = [ + "convert_case", + "proc-macro2", + "quote", + "rustc_version", + "syn 2.0.117", +] + [[package]] name = "difflib" version = "0.4.0" @@ -424,6 +552,15 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "document-features" +version = "0.2.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61" +dependencies = [ + "litrs", +] + [[package]] name = "either" version = "1.15.0" @@ -455,18 +592,60 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "euclid" +version = "0.22.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06" +dependencies = [ + "num-traits", +] + +[[package]] +name = "fancy-regex" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b95f7c0680e4142284cf8b22c14a476e87d61b004a3a0861872b32ef7ead40a2" +dependencies = [ + "bit-set", + "regex", +] + [[package]] name = "fastrand" version = "2.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6" +[[package]] +name = "filedescriptor" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e40758ed24c9b2eeb76c35fb0aebc66c626084edd827e07e1552279814c6682d" +dependencies = [ + "libc", + "thiserror 1.0.69", + "winapi", +] + [[package]] name = "find-msvc-tools" version = "0.1.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" +[[package]] +name = "finl_unicode" +version = "1.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5" + +[[package]] +name = "fixedbitset" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80" + [[package]] name = "float-cmp" version = "0.10.0" @@ -488,6 +667,12 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" +[[package]] +name = "foldhash" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" + [[package]] name = "foreign-types" version = "0.3.2" @@ -520,7 +705,7 @@ version = "0.1.11" dependencies = [ "assert_cmd", "clap", - "crossterm", + "crossterm 0.28.1", "dirs", "forensicnomicon", "predicates", @@ -627,6 +812,18 @@ dependencies = [ "wasi", ] +[[package]] +name = "getrandom" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" +dependencies = [ + "cfg-if", + "libc", + "r-efi 5.3.0", + "wasip2", +] + [[package]] name = "getrandom" version = "0.4.2" @@ -635,7 +832,7 @@ checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" dependencies = [ "cfg-if", "libc", - "r-efi", + "r-efi 6.0.0", "wasip2", "wasip3", ] @@ -664,10 +861,19 @@ name = "hashbrown" version = "0.15.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" +dependencies = [ + "foldhash 0.1.5", +] + +[[package]] +name = "hashbrown" +version = "0.16.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" dependencies = [ "allocator-api2", "equivalent", - "foldhash", + "foldhash 0.2.0", ] [[package]] @@ -675,6 +881,11 @@ name = "hashbrown" version = "0.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51" +dependencies = [ + "allocator-api2", + "equivalent", + "foldhash 0.2.0", +] [[package]] name = "heck" @@ -682,6 +893,12 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" +[[package]] +name = "hex" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" + [[package]] name = "http" version = "1.4.0" @@ -984,9 +1201,9 @@ checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695" [[package]] name = "itertools" -version = "0.13.0" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186" +checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" dependencies = [ "either", ] @@ -1009,6 +1226,29 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "kasuari" +version = "0.4.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bde5057d6143cc94e861d90f591b9303d6716c6b9602309150bd068853c10899" +dependencies = [ + "hashbrown 0.16.1", + "portable-atomic", + "thiserror 2.0.18", +] + +[[package]] +name = "lab" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf36173d4167ed999940f804952e6b08197cae5ad5d572eb4db150ce8ad5d58f" + +[[package]] +name = "lazy_static" +version = "1.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" + [[package]] name = "leb128fmt" version = "0.1.0" @@ -1021,6 +1261,12 @@ version = "0.2.185" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52ff2c0fe9bc6cb6b14a0592c2ff4fa9ceb83eea9db979b0487cd054946a2b8f" +[[package]] +name = "libm" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981" + [[package]] name = "libredox" version = "0.1.16" @@ -1030,6 +1276,15 @@ dependencies = [ "libc", ] +[[package]] +name = "line-clipping" +version = "0.3.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e752191d037c44ad111a8caa762921926658402f01cc1253f7bef2020ece4f5e" +dependencies = [ + "bitflags 2.13.1", +] + [[package]] name = "linux-raw-sys" version = "0.4.15" @@ -1048,6 +1303,12 @@ version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0" +[[package]] +name = "litrs" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092" + [[package]] name = "lock_api" version = "0.4.14" @@ -1065,11 +1326,21 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897" [[package]] name = "lru" -version = "0.12.5" +version = "0.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38" +checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a" dependencies = [ - "hashbrown 0.15.5", + "hashbrown 0.17.0", +] + +[[package]] +name = "mac_address" +version = "1.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0aeb26bf5e836cc1c341c8106051b573f1766dfa05aa87f0b98be5e51b02303" +dependencies = [ + "nix", + "winapi", ] [[package]] @@ -1087,6 +1358,21 @@ dependencies = [ "libc", ] +[[package]] +name = "memmem" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a64a92489e2744ce060c349162be1c5f33c6969234104dbd99ddb5feb08b8c15" + +[[package]] +name = "memoffset" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" +dependencies = [ + "autocfg", +] + [[package]] name = "miette" version = "7.6.0" @@ -1115,6 +1401,12 @@ version = "0.3.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a" +[[package]] +name = "minimal-lexical" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a" + [[package]] name = "mio" version = "1.2.0" @@ -1144,12 +1436,52 @@ dependencies = [ "tempfile", ] +[[package]] +name = "nix" +version = "0.29.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46" +dependencies = [ + "bitflags 2.13.1", + "cfg-if", + "cfg_aliases", + "libc", + "memoffset", +] + +[[package]] +name = "nom" +version = "7.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a" +dependencies = [ + "memchr", + "minimal-lexical", +] + [[package]] name = "normalize-line-endings" version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be" +[[package]] +name = "num-conv" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" + +[[package]] +name = "num-derive" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.117", +] + [[package]] name = "num-traits" version = "0.2.19" @@ -1159,6 +1491,15 @@ dependencies = [ "autocfg", ] +[[package]] +name = "num_threads" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9" +dependencies = [ + "libc", +] + [[package]] name = "once_cell" version = "1.21.4" @@ -1177,7 +1518,7 @@ version = "0.10.78" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f38c4372413cdaaf3cc79dd92d29d7d9f5ab09b51b10dded508fb90bb70b9222" dependencies = [ - "bitflags", + "bitflags 2.13.1", "cfg-if", "foreign-types", "libc", @@ -1222,40 +1563,170 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d" [[package]] -name = "parking_lot" -version = "0.12.5" +name = "ordered-float" +version = "4.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a" +checksum = "7bb71e1b3fa6ca1c61f383464aaf2bb0e2f8e772a1f01d486832464de363b951" dependencies = [ - "lock_api", - "parking_lot_core", + "num-traits", ] [[package]] -name = "parking_lot_core" -version = "0.9.12" +name = "palette" +version = "0.7.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1" +checksum = "ddeed8580d347d2abf3dcf06a5f0b3dc020258338526b277847cd4248a70fc64" dependencies = [ - "cfg-if", - "libc", - "redox_syscall", - "smallvec", - "windows-link", + "approx", + "libm", + "palette_derive", + "palette_math", ] [[package]] -name = "paste" -version = "1.0.15" +name = "palette_derive" +version = "0.7.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a" - -[[package]] -name = "percent-encoding" +checksum = "88537020289b719d81be994ccf1bbf4990f477e2f69ee52fe3e45f43a02e56be" +dependencies = [ + "by_address", + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "palette_math" +version = "0.7.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6e6eb142958d64335fb0e345c5b9ead2ecd6fc438c307e9d7d3c4fd428dbaf12" +dependencies = [ + "libm", +] + +[[package]] +name = "parking_lot" +version = "0.12.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a" +dependencies = [ + "lock_api", + "parking_lot_core", +] + +[[package]] +name = "parking_lot_core" +version = "0.9.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1" +dependencies = [ + "cfg-if", + "libc", + "redox_syscall", + "smallvec", + "windows-link", +] + +[[package]] +name = "percent-encoding" version = "2.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220" +[[package]] +name = "pest" +version = "2.8.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7df728be843c7070fab6ab7c328c4e9e9d78e23bf749c0669c86ee7ebfa050a2" +dependencies = [ + "memchr", + "ucd-trie", +] + +[[package]] +name = "pest_derive" +version = "2.8.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e2dd6fc3b26b3462ee188aac870f5a41d398f1cd5e2408d16531bd71c9591fd" +dependencies = [ + "pest", + "pest_generator", +] + +[[package]] +name = "pest_generator" +version = "2.8.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a7a9205cfb6f596a9e8b689c0a15f9ceb7a1aafae7aaf788150ac65b29975b6" +dependencies = [ + "pest", + "pest_meta", + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "pest_meta" +version = "2.8.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85abd351c0de1e8384fc791a0737111a350394937e92b956b743dac12429f57c" +dependencies = [ + "pest", +] + +[[package]] +name = "phf" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078" +dependencies = [ + "phf_macros", + "phf_shared", +] + +[[package]] +name = "phf_codegen" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a" +dependencies = [ + "phf_generator", + "phf_shared", +] + +[[package]] +name = "phf_generator" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" +dependencies = [ + "phf_shared", + "rand", +] + +[[package]] +name = "phf_macros" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216" +dependencies = [ + "phf_generator", + "phf_shared", + "proc-macro2", + "quote", + "syn 2.0.117", +] + +[[package]] +name = "phf_shared" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" +dependencies = [ + "siphasher", +] + [[package]] name = "pin-project-lite" version = "0.2.17" @@ -1268,6 +1739,12 @@ version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" +[[package]] +name = "portable-atomic" +version = "1.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3" + [[package]] name = "potential_utf" version = "0.1.5" @@ -1277,6 +1754,12 @@ dependencies = [ "zerovec", ] +[[package]] +name = "powerfmt" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" + [[package]] name = "predicates" version = "3.1.4" @@ -1335,40 +1818,141 @@ dependencies = [ "proc-macro2", ] +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + [[package]] name = "r-efi" version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" +[[package]] +name = "rand" +version = "0.8.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a" +dependencies = [ + "rand_core", +] + +[[package]] +name = "rand_core" +version = "0.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" + [[package]] name = "ratatui" -version = "0.29.0" +version = "0.30.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eabd94c2f37801c20583fc49dd5cd6b0ba68c716787c2dd6ed18571e1e63117b" +checksum = "3274ba0a2c5e1bcad2a2005d20f4dc59dad26b2eb0940fb094500dba4099d57d" dependencies = [ - "bitflags", - "cassowary", - "compact_str", - "crossterm", - "indoc", "instability", + "ratatui-core", + "ratatui-crossterm", + "ratatui-macros", + "ratatui-termina", + "ratatui-termwiz", + "ratatui-widgets", + "serde", +] + +[[package]] +name = "ratatui-core" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbb175c433c8e28a809d1f5773a2ae96e68c0ce40db865cbab1020bf33ae479c" +dependencies = [ + "bitflags 2.13.1", + "compact_str", + "critical-section", + "hashbrown 0.17.0", "itertools", + "kasuari", "lru", - "paste", + "palette", + "serde", "strum", + "thiserror 2.0.18", "unicode-segmentation", "unicode-truncate", "unicode-width 0.2.0", ] +[[package]] +name = "ratatui-crossterm" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "567584a3b0e6a8203c23de40b4861497266725eb5363dbfd18a1edd603cca9f0" +dependencies = [ + "cfg-if", + "crossterm 0.29.0", + "instability", + "ratatui-core", +] + +[[package]] +name = "ratatui-macros" +version = "0.7.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed7dc68daa7498a43e4d68e0eb078427e10c38fbcfbb1e42d955f1fa2140d814" +dependencies = [ + "ratatui-core", + "ratatui-widgets", +] + +[[package]] +name = "ratatui-termina" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0bf912d9e66f057a759d92e386a280ea886b352ab757d6ac4d653c7ed2c43c2" +dependencies = [ + "instability", + "ratatui-core", + "termina", +] + +[[package]] +name = "ratatui-termwiz" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "faf03e0380b7744054d6cb74224fe3adf062a029754933f575ca1e3b4c2ce977" +dependencies = [ + "ratatui-core", + "termwiz", +] + +[[package]] +name = "ratatui-widgets" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "66e3d19bcc9130ca376277d93b60767ff121ace3be06f5f95f81dd68956407d1" +dependencies = [ + "bitflags 2.13.1", + "hashbrown 0.17.0", + "indoc", + "instability", + "itertools", + "line-clipping", + "ratatui-core", + "serde", + "strum", + "time", + "unicode-segmentation", + "unicode-width 0.2.0", +] + [[package]] name = "redox_syscall" version = "0.5.18" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d" dependencies = [ - "bitflags", + "bitflags 2.13.1", ] [[package]] @@ -1467,13 +2051,22 @@ dependencies = [ "windows-sys 0.52.0", ] +[[package]] +name = "rustc_version" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92" +dependencies = [ + "semver", +] + [[package]] name = "rustix" version = "0.38.44" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154" dependencies = [ - "bitflags", + "bitflags 2.13.1", "errno", "libc", "linux-raw-sys 0.4.15", @@ -1486,7 +2079,7 @@ version = "1.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" dependencies = [ - "bitflags", + "bitflags 2.13.1", "errno", "libc", "linux-raw-sys 0.12.1", @@ -1559,7 +2152,7 @@ version = "3.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" dependencies = [ - "bitflags", + "bitflags 2.13.1", "core-foundation 0.10.1", "core-foundation-sys", "libc", @@ -1707,6 +2300,12 @@ dependencies = [ "libc", ] +[[package]] +name = "siphasher" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649" + [[package]] name = "slab" version = "0.4.12" @@ -1749,23 +2348,22 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" [[package]] name = "strum" -version = "0.26.3" +version = "0.28.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06" +checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd" dependencies = [ "strum_macros", ] [[package]] name = "strum_macros" -version = "0.26.4" +version = "0.28.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be" +checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664" dependencies = [ "heck", "proc-macro2", "quote", - "rustversion", "syn 2.0.117", ] @@ -1823,7 +2421,7 @@ version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b" dependencies = [ - "bitflags", + "bitflags 2.13.1", "core-foundation 0.9.4", "system-configuration-sys", ] @@ -1851,12 +2449,88 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "termina" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9048a889effe34a5cddee0af7f53285198b16dca3be510858d38dfdb3e62a04e" +dependencies = [ + "bitflags 2.13.1", + "parking_lot", + "rustix 1.1.4", + "signal-hook", + "windows-sys 0.61.2", +] + +[[package]] +name = "terminfo" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d4ea810f0692f9f51b382fff5893887bb4580f5fa246fde546e0b13e7fcee662" +dependencies = [ + "fnv", + "nom", + "phf", + "phf_codegen", +] + +[[package]] +name = "termios" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b" +dependencies = [ + "libc", +] + [[package]] name = "termtree" version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683" +[[package]] +name = "termwiz" +version = "0.23.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4676b37242ccbd1aabf56edb093a4827dc49086c0ffd764a5705899e0f35f8f7" +dependencies = [ + "anyhow", + "base64", + "bitflags 2.13.1", + "fancy-regex", + "filedescriptor", + "finl_unicode", + "fixedbitset", + "hex", + "lazy_static", + "libc", + "log", + "memmem", + "nix", + "num-derive", + "num-traits", + "ordered-float", + "pest", + "pest_derive", + "phf", + "sha2", + "signal-hook", + "siphasher", + "terminfo", + "termios", + "thiserror 1.0.69", + "ucd-trie", + "unicode-segmentation", + "vtparse", + "wezterm-bidi", + "wezterm-blob-leases", + "wezterm-color-types", + "wezterm-dynamic", + "wezterm-input-types", + "winapi", +] + [[package]] name = "thiserror" version = "1.0.69" @@ -1897,6 +2571,27 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "time" +version = "0.3.55" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134" +dependencies = [ + "deranged", + "libc", + "num-conv", + "num_threads", + "powerfmt", + "serde_core", + "time-core", +] + +[[package]] +name = "time-core" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109" + [[package]] name = "tinystr" version = "0.8.3" @@ -2016,7 +2711,7 @@ version = "0.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8" dependencies = [ - "bitflags", + "bitflags 2.13.1", "bytes", "futures-util", "http", @@ -2071,6 +2766,12 @@ version = "1.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de" +[[package]] +name = "ucd-trie" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971" + [[package]] name = "unicode-ident" version = "1.0.24" @@ -2085,13 +2786,13 @@ checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c" [[package]] name = "unicode-truncate" -version = "1.1.0" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b3644627a5af5fa321c95b9b235a72fd24cd29c648c2c379431e6628655627bf" +checksum = "16b380a1238663e5f8a691f9039c73e1cdae598a30e9855f541d29b08b53e9a5" dependencies = [ "itertools", "unicode-segmentation", - "unicode-width 0.1.14", + "unicode-width 0.2.0", ] [[package]] @@ -2148,6 +2849,18 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.24.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239" +dependencies = [ + "atomic", + "getrandom 0.4.2", + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vcpkg" version = "0.2.15" @@ -2160,6 +2873,15 @@ version = "0.9.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" +[[package]] +name = "vtparse" +version = "0.6.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6d9b2acfb050df409c972a37d3b8e08cdea3bddb0c09db9d53137e504cfabed0" +dependencies = [ + "utf8parse", +] + [[package]] name = "wait-timeout" version = "0.2.1" @@ -2285,7 +3007,7 @@ version = "0.244.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe" dependencies = [ - "bitflags", + "bitflags 2.13.1", "hashbrown 0.15.5", "indexmap", "semver", @@ -2301,6 +3023,78 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "wezterm-bidi" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c0a6e355560527dd2d1cf7890652f4f09bb3433b6aadade4c9b5ed76de5f3ec" +dependencies = [ + "log", + "wezterm-dynamic", +] + +[[package]] +name = "wezterm-blob-leases" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "692daff6d93d94e29e4114544ef6d5c942a7ed998b37abdc19b17136ea428eb7" +dependencies = [ + "getrandom 0.3.4", + "mac_address", + "sha2", + "thiserror 1.0.69", + "uuid", +] + +[[package]] +name = "wezterm-color-types" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7de81ef35c9010270d63772bebef2f2d6d1f2d20a983d27505ac850b8c4b4296" +dependencies = [ + "csscolorparser", + "deltae", + "lazy_static", + "wezterm-dynamic", +] + +[[package]] +name = "wezterm-dynamic" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5f2ab60e120fd6eaa68d9567f3226e876684639d22a4219b313ff69ec0ccd5ac" +dependencies = [ + "log", + "ordered-float", + "strsim", + "thiserror 1.0.69", + "wezterm-dynamic-derive", +] + +[[package]] +name = "wezterm-dynamic-derive" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c0cf2d539c645b448eaffec9ec494b8b19bd5077d9e58cb1ae7efece8d575b" +dependencies = [ + "proc-macro2", + "quote", + "syn 1.0.109", +] + +[[package]] +name = "wezterm-input-types" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7012add459f951456ec9d6c7e6fc340b1ce15d6fc9629f8c42853412c029e57e" +dependencies = [ + "bitflags 1.3.2", + "euclid", + "lazy_static", + "serde", + "wezterm-dynamic", +] + [[package]] name = "winapi" version = "0.3.9" @@ -2537,7 +3331,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "af272475b34a42d387930688120019e7ec99bbf79ecaa8c036d853cb2442a10e" dependencies = [ "binrw", - "bitflags", + "bitflags 2.13.1", ] [[package]] @@ -2604,7 +3398,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2" dependencies = [ "anyhow", - "bitflags", + "bitflags 2.13.1", "indexmap", "log", "serde", diff --git a/crates/4n6query/Cargo.toml b/crates/4n6query/Cargo.toml index b832326..5b868d9 100644 --- a/crates/4n6query/Cargo.toml +++ b/crates/4n6query/Cargo.toml @@ -30,7 +30,7 @@ serde = { workspace = true } serde_json = { workspace = true } serde_yaml = { workspace = true } # TUI -ratatui = "0.29" +ratatui = "0.30" crossterm = "0.28" toml = "0.8" dirs = "5" diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 1b9e628..34c2b2f 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -3,6 +3,36 @@ [audits] +[[trusted.ewf]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-03-05" +end = "2027-08-06" + +[[trusted.forensicnomicon]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-05" +end = "2027-08-06" + +[[trusted.forensicnomicon-core]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-06" + +[[trusted.forensicnomicon-data]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-28" +end = "2027-08-06" + +[[trusted.safe-read]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-07-15" +end = "2027-08-06" + [[trusted.winreg-core]] criteria = "safe-to-deploy" user-id = 347968 # Albert Hui (h4x0r) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 3c8c920..f763e19 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -56,13 +56,21 @@ criteria = "safe-to-deploy" version = "1.0.104" criteria = "safe-to-deploy" +[[exemptions.approx]] +version = "0.5.1" +criteria = "safe-to-deploy" + [[exemptions.assert_cmd]] version = "2.2.1" criteria = "safe-to-run" +[[exemptions.atomic]] +version = "0.6.1" +criteria = "safe-to-deploy" + [[exemptions.autocfg]] version = "1.5.0" -criteria = "safe-to-run" +criteria = "safe-to-deploy" [[exemptions.binrw]] version = "0.4.0" @@ -72,16 +80,24 @@ criteria = "safe-to-run" version = "0.4.0" criteria = "safe-to-run" +[[exemptions.bitflags]] +version = "2.13.1" +criteria = "safe-to-deploy" + [[exemptions.block-buffer]] version = "0.10.4" criteria = "safe-to-deploy" -[[exemptions.bytes]] -version = "1.11.1" +[[exemptions.by_address]] +version = "1.2.1" criteria = "safe-to-deploy" -[[exemptions.cassowary]] -version = "0.3.0" +[[exemptions.bytemuck]] +version = "1.25.2" +criteria = "safe-to-deploy" + +[[exemptions.bytes]] +version = "1.11.1" criteria = "safe-to-deploy" [[exemptions.castaway]] @@ -121,7 +137,11 @@ version = "1.0.5" criteria = "safe-to-deploy" [[exemptions.compact_str]] -version = "0.8.1" +version = "0.9.1" +criteria = "safe-to-deploy" + +[[exemptions.convert_case]] +version = "0.10.0" criteria = "safe-to-deploy" [[exemptions.core-foundation]] @@ -132,10 +152,18 @@ criteria = "safe-to-deploy" version = "0.2.17" criteria = "safe-to-deploy" +[[exemptions.critical-section]] +version = "1.2.0" +criteria = "safe-to-deploy" + [[exemptions.crossterm]] version = "0.28.1" criteria = "safe-to-deploy" +[[exemptions.crossterm]] +version = "0.29.0" +criteria = "safe-to-deploy" + [[exemptions.crossterm_winapi]] version = "0.9.1" criteria = "safe-to-deploy" @@ -144,6 +172,10 @@ criteria = "safe-to-deploy" version = "0.1.7" criteria = "safe-to-deploy" +[[exemptions.csscolorparser]] +version = "0.6.2" +criteria = "safe-to-deploy" + [[exemptions.darling]] version = "0.23.0" criteria = "safe-to-deploy" @@ -156,6 +188,18 @@ criteria = "safe-to-deploy" version = "0.23.0" criteria = "safe-to-deploy" +[[exemptions.deltae]] +version = "0.3.2" +criteria = "safe-to-deploy" + +[[exemptions.derive_more]] +version = "2.1.1" +criteria = "safe-to-deploy" + +[[exemptions.derive_more-impl]] +version = "2.1.1" +criteria = "safe-to-deploy" + [[exemptions.digest]] version = "0.10.7" criteria = "safe-to-deploy" @@ -168,18 +212,34 @@ criteria = "safe-to-deploy" version = "0.4.1" criteria = "safe-to-deploy" +[[exemptions.document-features]] +version = "0.2.12" +criteria = "safe-to-deploy" + [[exemptions.errno]] version = "0.3.14" criteria = "safe-to-deploy" +[[exemptions.fancy-regex]] +version = "0.11.0" +criteria = "safe-to-deploy" + [[exemptions.fastrand]] version = "2.4.1" criteria = "safe-to-deploy" +[[exemptions.filedescriptor]] +version = "0.8.3" +criteria = "safe-to-deploy" + [[exemptions.find-msvc-tools]] version = "0.1.9" criteria = "safe-to-deploy" +[[exemptions.finl_unicode]] +version = "1.4.0" +criteria = "safe-to-deploy" + [[exemptions.float-cmp]] version = "0.10.0" criteria = "safe-to-run" @@ -216,6 +276,10 @@ criteria = "safe-to-deploy" version = "0.2.17" criteria = "safe-to-deploy" +[[exemptions.getrandom]] +version = "0.3.4" +criteria = "safe-to-deploy" + [[exemptions.getrandom]] version = "0.4.2" criteria = "safe-to-deploy" @@ -292,10 +356,6 @@ criteria = "safe-to-deploy" version = "2.3.0" criteria = "safe-to-deploy" -[[exemptions.indexmap]] -version = "2.14.0" -criteria = "safe-to-deploy" - [[exemptions.indoc]] version = "2.0.7" criteria = "safe-to-deploy" @@ -317,7 +377,7 @@ version = "1.70.2" criteria = "safe-to-deploy" [[exemptions.itertools]] -version = "0.13.0" +version = "0.10.3" criteria = "safe-to-deploy" [[exemptions.itoa]] @@ -328,14 +388,30 @@ criteria = "safe-to-deploy" version = "0.3.95" criteria = "safe-to-deploy" +[[exemptions.kasuari]] +version = "0.4.12" +criteria = "safe-to-deploy" + +[[exemptions.lab]] +version = "0.11.0" +criteria = "safe-to-deploy" + [[exemptions.libc]] version = "0.2.185" criteria = "safe-to-deploy" +[[exemptions.libm]] +version = "0.2.16" +criteria = "safe-to-deploy" + [[exemptions.libredox]] version = "0.1.16" criteria = "safe-to-deploy" +[[exemptions.line-clipping]] +version = "0.3.8" +criteria = "safe-to-deploy" + [[exemptions.linux-raw-sys]] version = "0.4.15" criteria = "safe-to-deploy" @@ -348,12 +424,20 @@ criteria = "safe-to-deploy" version = "0.8.2" criteria = "safe-to-deploy" +[[exemptions.litrs]] +version = "1.0.0" +criteria = "safe-to-deploy" + [[exemptions.lock_api]] version = "0.4.14" criteria = "safe-to-deploy" [[exemptions.lru]] -version = "0.12.5" +version = "0.18.2" +criteria = "safe-to-deploy" + +[[exemptions.mac_address]] +version = "1.1.8" criteria = "safe-to-deploy" [[exemptions.memchr]] @@ -364,6 +448,14 @@ criteria = "safe-to-deploy" version = "0.9.10" criteria = "safe-to-run" +[[exemptions.memmem]] +version = "0.1.1" +criteria = "safe-to-deploy" + +[[exemptions.memoffset]] +version = "0.9.1" +criteria = "safe-to-deploy" + [[exemptions.miette]] version = "7.6.0" criteria = "safe-to-run" @@ -376,6 +468,10 @@ criteria = "safe-to-run" version = "0.3.17" criteria = "safe-to-deploy" +[[exemptions.minimal-lexical]] +version = "0.2.1" +criteria = "safe-to-deploy" + [[exemptions.mio]] version = "1.2.0" criteria = "safe-to-deploy" @@ -384,6 +480,18 @@ criteria = "safe-to-deploy" version = "0.2.18" criteria = "safe-to-deploy" +[[exemptions.nix]] +version = "0.15.0" +criteria = "safe-to-deploy" + +[[exemptions.num-conv]] +version = "0.2.2" +criteria = "safe-to-deploy" + +[[exemptions.num_threads]] +version = "0.1.7" +criteria = "safe-to-deploy" + [[exemptions.once_cell]] version = "1.21.4" criteria = "safe-to-deploy" @@ -404,6 +512,22 @@ criteria = "safe-to-deploy" version = "0.9.114" criteria = "safe-to-deploy" +[[exemptions.ordered-float]] +version = "4.6.0" +criteria = "safe-to-deploy" + +[[exemptions.palette]] +version = "0.7.7" +criteria = "safe-to-deploy" + +[[exemptions.palette_derive]] +version = "0.7.7" +criteria = "safe-to-deploy" + +[[exemptions.palette_math]] +version = "0.7.7" +criteria = "safe-to-deploy" + [[exemptions.parking_lot]] version = "0.12.5" criteria = "safe-to-deploy" @@ -412,8 +536,40 @@ criteria = "safe-to-deploy" version = "0.9.12" criteria = "safe-to-deploy" -[[exemptions.paste]] -version = "1.0.15" +[[exemptions.pest]] +version = "2.8.8" +criteria = "safe-to-deploy" + +[[exemptions.pest_derive]] +version = "2.8.8" +criteria = "safe-to-deploy" + +[[exemptions.pest_generator]] +version = "2.8.8" +criteria = "safe-to-deploy" + +[[exemptions.pest_meta]] +version = "2.8.8" +criteria = "safe-to-deploy" + +[[exemptions.phf]] +version = "0.11.3" +criteria = "safe-to-deploy" + +[[exemptions.phf_codegen]] +version = "0.11.3" +criteria = "safe-to-deploy" + +[[exemptions.phf_generator]] +version = "0.11.3" +criteria = "safe-to-deploy" + +[[exemptions.phf_macros]] +version = "0.11.3" +criteria = "safe-to-deploy" + +[[exemptions.phf_shared]] +version = "0.11.3" criteria = "safe-to-deploy" [[exemptions.pin-project-lite]] @@ -424,6 +580,10 @@ criteria = "safe-to-deploy" version = "0.3.33" criteria = "safe-to-deploy" +[[exemptions.portable-atomic]] +version = "1.14.0" +criteria = "safe-to-deploy" + [[exemptions.potential_utf]] version = "0.1.5" criteria = "safe-to-deploy" @@ -432,12 +592,44 @@ criteria = "safe-to-deploy" version = "0.2.37" criteria = "safe-to-deploy" +[[exemptions.r-efi]] +version = "5.3.0" +criteria = "safe-to-deploy" + [[exemptions.r-efi]] version = "6.0.0" criteria = "safe-to-deploy" +[[exemptions.rand]] +version = "0.8.7" +criteria = "safe-to-deploy" + [[exemptions.ratatui]] -version = "0.29.0" +version = "0.30.2" +criteria = "safe-to-deploy" + +[[exemptions.ratatui-core]] +version = "0.1.2" +criteria = "safe-to-deploy" + +[[exemptions.ratatui-crossterm]] +version = "0.1.2" +criteria = "safe-to-deploy" + +[[exemptions.ratatui-macros]] +version = "0.7.2" +criteria = "safe-to-deploy" + +[[exemptions.ratatui-termina]] +version = "0.1.0" +criteria = "safe-to-deploy" + +[[exemptions.ratatui-termwiz]] +version = "0.1.2" +criteria = "safe-to-deploy" + +[[exemptions.ratatui-widgets]] +version = "0.3.2" criteria = "safe-to-deploy" [[exemptions.redox_syscall]] @@ -468,6 +660,10 @@ criteria = "safe-to-deploy" version = "0.17.14" criteria = "safe-to-deploy" +[[exemptions.rustc_version]] +version = "0.4.1" +criteria = "safe-to-deploy" + [[exemptions.rustix]] version = "0.38.44" criteria = "safe-to-deploy" @@ -512,10 +708,6 @@ criteria = "safe-to-deploy" version = "2.17.0" criteria = "safe-to-deploy" -[[exemptions.semver]] -version = "1.0.28" -criteria = "safe-to-deploy" - [[exemptions.serde]] version = "1.0.228" criteria = "safe-to-deploy" @@ -560,6 +752,10 @@ criteria = "safe-to-deploy" version = "1.4.8" criteria = "safe-to-deploy" +[[exemptions.siphasher]] +version = "1.0.3" +criteria = "safe-to-deploy" + [[exemptions.slab]] version = "0.4.12" criteria = "safe-to-deploy" @@ -572,10 +768,22 @@ criteria = "safe-to-deploy" version = "1.2.1" criteria = "safe-to-deploy" +[[exemptions.strum]] +version = "0.28.0" +criteria = "safe-to-deploy" + +[[exemptions.strum_macros]] +version = "0.28.0" +criteria = "safe-to-deploy" + [[exemptions.subtle]] version = "2.6.1" criteria = "safe-to-deploy" +[[exemptions.syn]] +version = "1.0.109" +criteria = "safe-to-deploy" + [[exemptions.syn]] version = "2.0.117" criteria = "safe-to-deploy" @@ -596,13 +804,29 @@ criteria = "safe-to-deploy" version = "3.27.0" criteria = "safe-to-deploy" +[[exemptions.termina]] +version = "0.3.3" +criteria = "safe-to-deploy" + +[[exemptions.terminfo]] +version = "0.9.0" +criteria = "safe-to-deploy" + +[[exemptions.termios]] +version = "0.3.3" +criteria = "safe-to-deploy" + +[[exemptions.termwiz]] +version = "0.23.3" +criteria = "safe-to-deploy" + [[exemptions.thiserror]] version = "1.0.69" criteria = "safe-to-deploy" [[exemptions.thiserror]] version = "2.0.18" -criteria = "safe-to-run" +criteria = "safe-to-deploy" [[exemptions.thiserror-impl]] version = "1.0.69" @@ -610,7 +834,15 @@ criteria = "safe-to-deploy" [[exemptions.thiserror-impl]] version = "2.0.18" -criteria = "safe-to-run" +criteria = "safe-to-deploy" + +[[exemptions.time]] +version = "0.3.55" +criteria = "safe-to-deploy" + +[[exemptions.time-core]] +version = "0.1.9" +criteria = "safe-to-deploy" [[exemptions.tinystr]] version = "0.8.3" @@ -676,12 +908,16 @@ criteria = "safe-to-deploy" version = "1.20.0" criteria = "safe-to-deploy" +[[exemptions.ucd-trie]] +version = "0.1.7" +criteria = "safe-to-deploy" + [[exemptions.unicode-ident]] version = "1.0.24" criteria = "safe-to-deploy" [[exemptions.unicode-truncate]] -version = "1.1.0" +version = "2.0.1" criteria = "safe-to-deploy" [[exemptions.unsafe-libyaml]] @@ -696,10 +932,18 @@ criteria = "safe-to-deploy" version = "2.5.8" criteria = "safe-to-deploy" +[[exemptions.uuid]] +version = "1.24.0" +criteria = "safe-to-deploy" + [[exemptions.version_check]] version = "0.9.5" criteria = "safe-to-deploy" +[[exemptions.vtparse]] +version = "0.6.2" +criteria = "safe-to-deploy" + [[exemptions.want]] version = "0.3.1" criteria = "safe-to-deploy" @@ -732,6 +976,30 @@ criteria = "safe-to-deploy" version = "0.3.95" criteria = "safe-to-deploy" +[[exemptions.wezterm-bidi]] +version = "0.2.3" +criteria = "safe-to-deploy" + +[[exemptions.wezterm-blob-leases]] +version = "0.1.1" +criteria = "safe-to-deploy" + +[[exemptions.wezterm-color-types]] +version = "0.3.0" +criteria = "safe-to-deploy" + +[[exemptions.wezterm-dynamic]] +version = "0.2.1" +criteria = "safe-to-deploy" + +[[exemptions.wezterm-dynamic-derive]] +version = "0.1.1" +criteria = "safe-to-deploy" + +[[exemptions.wezterm-input-types]] +version = "0.1.0" +criteria = "safe-to-deploy" + [[exemptions.winapi]] version = "0.3.9" criteria = "safe-to-deploy" @@ -875,7 +1143,3 @@ criteria = "safe-to-deploy" [[exemptions.zerovec-derive]] version = "0.11.3" criteria = "safe-to-deploy" - -[[exemptions.zmij]] -version = "1.0.21" -criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 462c578..a001857 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -22,6 +22,13 @@ user-id = 4484 user-login = "hsivonen" user-name = "Henri Sivonen" +[[publisher.euclid]] +version = "0.22.14" +when = "2026-03-18" +user-id = 1281 +user-login = "nical" +user-name = "Nicolas Silva" + [[publisher.unicode-segmentation]] version = "1.13.2" when = "2026-03-26" @@ -254,46 +261,25 @@ criteria = "safe-to-deploy" version = "1.1.2" notes = "Contains `unsafe` code but it's well-documented and scoped to what it's intended to be doing. Otherwise a well-focused and straightforward crate." -[[audits.bytecode-alliance.audits.bitflags]] -who = "Jamey Sharp " -criteria = "safe-to-deploy" -delta = "2.1.0 -> 2.2.1" -notes = """ -This version adds unsafe impls of traits from the bytemuck crate when built -with that library enabled, but I believe the impls satisfy the documented -safety requirements for bytemuck. The other changes are minor. -""" - -[[audits.bytecode-alliance.audits.bitflags]] -who = "Alex Crichton " +[[audits.bytecode-alliance.audits.fixedbitset]] +who = "Nick Fitzgerald " criteria = "safe-to-deploy" -delta = "2.3.2 -> 2.3.3" +version = "0.4.2" notes = """ -Nothing outside the realm of what one would expect from a bitflags generator, -all as expected. +No ambient I/O. Uses some `unsafe`, but the uses look good and are guarded by +relevant assertions, although could use some comments and some slight +refactoring into helpers to dedupe unsafe blocks in my personal opinion. """ -[[audits.bytecode-alliance.audits.bitflags]] +[[audits.bytecode-alliance.audits.foldhash]] who = "Alex Crichton " criteria = "safe-to-deploy" -delta = "2.4.1 -> 2.6.0" +version = "0.1.3" notes = """ -Changes in how macros are invoked and various bits and pieces of macro-fu. -Otherwise no major changes and nothing dealing with `unsafe`. +Only a minor amount of `unsafe` code in this crate related to global per-process +initialization which looks correct to me. """ -[[audits.bytecode-alliance.audits.bitflags]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -delta = "2.7.0 -> 2.9.4" -notes = "Tweaks to the macro, nothing out of order." - -[[audits.bytecode-alliance.audits.bitflags]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -delta = "2.10.0 -> 2.11.1" -notes = "Minor updates, nothing awry here." - [[audits.bytecode-alliance.audits.foreign-types]] who = "Pat Hickey " criteria = "safe-to-deploy" @@ -322,6 +308,24 @@ crate is broadly used throughout the ecosystem and does not contain anything suspicious. """ +[[audits.bytecode-alliance.audits.itertools]] +who = "Nick Fitzgerald " +criteria = "safe-to-deploy" +delta = "0.10.5 -> 0.12.1" +notes = """ +Minimal `unsafe` usage. Few blocks that existed looked reasonable. Does what it +says on the tin: lots of iterators. +""" + +[[audits.bytecode-alliance.audits.itertools]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.12.1 -> 0.14.0" +notes = """ +Lots of new iterators and shuffling some things around. Some new unsafe code but +it's well-documented and well-tested. Nothing suspicious. +""" + [[audits.bytecode-alliance.audits.leb128fmt]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -338,6 +342,12 @@ a few `unsafe` blocks related to utf-8 validation which are locally verifiable as correct and otherwise this crate is good to go. """ +[[audits.bytecode-alliance.audits.semver]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +version = "1.0.17" +notes = "plenty of unsafe pointer and vec tricks, but in well-structured and commented code that appears to be correct" + [[audits.bytecode-alliance.audits.shlex]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -415,6 +425,12 @@ criteria = "safe-to-deploy" version = "2.1.0" notes = "Some unsafe usage but with safety comments and tests, and appear sound but didn't do detailed evaluation. No ambient capabilities" +[[audits.embark.audits.cfg_aliases]] +who = "Johan Andersson " +criteria = "safe-to-deploy" +version = "0.1.1" +notes = "No unsafe usage or ambient capabilities" + [[audits.embark.audits.ident_case]] who = "Johan Andersson " criteria = "safe-to-deploy" @@ -545,18 +561,6 @@ delta = "1.0.1 -> 1.0.2" notes = "No changes to any .rs files or Rust code." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.foldhash]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "0.1.3" -notes = """ -`ub-risk-2` review notes can be found in https://crrev.com/c/6071306/5/third_party/rust/chromium_crates_io/vendor/foldhash-0.1.3/src/seed.rs - -`does-not-implement-crypto` based on `README.md` which explicitly says that -"Foldhash is **not appropriate for any cryptographic purpose**." -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.foldhash]] who = "Adrian Taylor " criteria = "safe-to-deploy" @@ -584,6 +588,52 @@ https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24 """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "2.7.1" +notes = ''' +Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'` +and there were no hits. + +There is a little bit of `unsafe` Rust code - the audit can be found at +https://chromium-review.googlesource.com/c/chromium/src/+/6187726/2 +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.indexmap]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "2.7.1 -> 2.8.0" +notes = """ +No `unsafe` introduced or affected in: +* `indexmap_with_default!` and `indexset_with_default!` macros +* New `PartialEq` implementations +* `fn slice_eq` in `util.rs` +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.lazy_static]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "1.4.0" +notes = ''' +I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits. + +There are two places where `unsafe` is used. Unsafe review notes can be found +in https://crrev.com/c/5347418. + +This crate has been added to Chromium in https://crrev.com/c/3321895. +''' +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.lazy_static]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "1.4.0 -> 1.5.0" +notes = "Unsafe review notes: https://crrev.com/c/5650836" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.log]] who = "danakj " criteria = "safe-to-deploy" @@ -610,6 +660,15 @@ delta = "0.4.25 -> 0.4.26" notes = "Only trivial code and documentation changes." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.nom]] +who = "danakj@chromium.org" +criteria = "safe-to-deploy" +version = "7.1.3" +notes = """ +Reviewed in https://chromium-review.googlesource.com/c/chromium/src/+/5046153 +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.normalize-line-endings]] who = "Max Lee " criteria = "safe-to-run" @@ -822,6 +881,15 @@ Still no `unsafe` anywhere. """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.rand_core]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +version = "0.6.4" +notes = """ +For more detailed unsafe review notes please see https://crrev.com/c/6362797 +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.smallvec]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -870,39 +938,6 @@ Previously reviewed during security review and the audit is grandparented in. """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.strum]] -who = "danakj@chromium.org" -criteria = "safe-to-deploy" -version = "0.25.0" -notes = """ -Reviewed in https://crrev.com/c/5171063 - -Previously reviewed during security review and the audit is grandparented in. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.strum_macros]] -who = "danakj@chromium.org" -criteria = "safe-to-deploy" -version = "0.25.3" -notes = """ -Reviewed in https://crrev.com/c/5171063 - -Previously reviewed during security review and the audit is grandparented in. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.syn]] -who = "danakj@chromium.org" -criteria = "safe-to-run" -version = "1.0.109" -notes = """ -Reviewed in https://crrev.com/c/5171063 - -Previously reviewed during security review and the audit is grandparented in. -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.synstructure]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -948,6 +983,15 @@ end = "2025-10-23" notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.wildcard-audits.euclid]] +who = "Nicolas Silva " +criteria = "safe-to-deploy" +user-id = 1281 # Nicolas Silva (nical) +start = "2019-03-14" +end = "2027-01-15" +notes = "I wrote most of the commits in the euclid reprository and review every change that is not produced by me." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.wildcard-audits.unicode-segmentation]] who = "Manish Goregaokar " criteria = "safe-to-deploy" @@ -996,59 +1040,45 @@ criteria = "safe-to-deploy" delta = "0.2.20 -> 0.2.21" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.bitflags]] -who = "Alex Franchuk " -criteria = "safe-to-deploy" -delta = "1.3.2 -> 2.0.2" -notes = "Removal of some unsafe code/methods. No changes to externals, just some refactoring (mostly internal)." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.bitflags]] -who = "Nicolas Silva " +[[audits.mozilla.audits.bit-set]] +who = "Aria Beingessner " criteria = "safe-to-deploy" -delta = "2.0.2 -> 2.1.0" +version = "0.5.2" +notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.bitflags]] -who = "Teodor Tanasoaia " +[[audits.mozilla.audits.bit-set]] +who = "Mike Hommey " criteria = "safe-to-deploy" -delta = "2.2.1 -> 2.3.2" +delta = "0.5.2 -> 0.5.3" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.bitflags]] -who = "Mike Hommey " +[[audits.mozilla.audits.bit-vec]] +who = "Aria Beingessner " criteria = "safe-to-deploy" -delta = "2.3.3 -> 2.4.0" +version = "0.6.3" +notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.bitflags]] +[[audits.mozilla.audits.bstr]] who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "2.4.0 -> 2.4.1" -notes = "Only allowing new clippy lints" +criteria = "safe-to-run" +delta = "1.11.3 -> 1.12.1" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -[[audits.mozilla.audits.bitflags]] -who = [ - "Teodor Tanasoaia ", - "Erich Gubler ", -] +[[audits.mozilla.audits.cfg_aliases]] +who = "Alex Franchuk " criteria = "safe-to-deploy" -delta = "2.6.0 -> 2.7.0" +delta = "0.1.1 -> 0.2.1" +notes = "Very minor changes." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.bitflags]] -who = "Benjamin VanderSloot " +[[audits.mozilla.audits.cfg_aliases]] +who = "Erich Gubler " criteria = "safe-to-deploy" -delta = "2.9.4 -> 2.10.0" +delta = "0.2.1 -> 0.2.2" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.bstr]] -who = "Jan-Erik Rediger " -criteria = "safe-to-run" -delta = "1.11.3 -> 1.12.1" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - [[audits.mozilla.audits.core-foundation]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" @@ -1056,6 +1086,30 @@ delta = "0.9.3 -> 0.9.4" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.deranged]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.3.11" +notes = """ +This crate contains a decent bit of `unsafe` code, however all internal +unsafety is verified with copious assertions (many are compile-time), and +otherwise the unsafety is documented and left to the caller to verify. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.deranged]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +delta = "0.3.11 -> 0.4.0" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.deranged]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +delta = "0.4.0 -> 0.5.8" +notes = "New unsafe code is properly guarded" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.fnv]] who = "Bobby Holley " criteria = "safe-to-deploy" @@ -1063,6 +1117,12 @@ version = "1.0.7" notes = "Simple hasher implementation with no unsafe code." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.foldhash]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.1.5 -> 0.2.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" @@ -1099,6 +1159,12 @@ criteria = "safe-to-deploy" delta = "0.16.1 -> 0.17.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.hex]] +who = "Simon Friedberger " +criteria = "safe-to-deploy" +version = "0.4.3" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" @@ -1136,12 +1202,91 @@ criteria = "safe-to-deploy" delta = "1.2.0 -> 1.2.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.indexmap]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "2.8.0 -> 2.11.4" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.indexmap]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "2.11.4 -> 2.14.0" +notes = "Mostly internal refactorings. No new unsafe code." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.itertools]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.10.3 -> 0.10.5" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.log]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.4.26 -> 0.4.29" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.nix]] +who = "Gabriele Svelto " +criteria = "safe-to-deploy" +delta = "0.15.0 -> 0.25.0" +notes = "Plenty of new bindings but also several important bug fixes (including buffer overflows). New unsafe sections are restricted to wrappers and are no more dangerous than calling the C functions." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.nix]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.25.0 -> 0.25.1" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.nix]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.25.1 -> 0.26.2" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.nix]] +who = "Gabriele Svelto " +criteria = "safe-to-deploy" +delta = "0.26.2 -> 0.27.1" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.nix]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.27.1 -> 0.28.0" +notes = """ +Many new features and bugfixes. Obviously there's a lot of unsafe code calling +libc, but the usage looks correct. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.nix]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.28.0 -> 0.29.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.num-derive]] +who = "Josh Stone " +criteria = "safe-to-deploy" +version = "0.3.3" +notes = "All code written or reviewed by Josh Stone." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.num-derive]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.3 -> 0.4.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.num-derive]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.4.0 -> 0.4.2" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.option-ext]] who = "Nika Layzell " criteria = "safe-to-deploy" @@ -1166,6 +1311,16 @@ criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.powerfmt]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.2.0" +notes = """ +A tiny bit of unsafe code to implement functionality that isn't in stable rust +yet, but it's all valid. Otherwise it's a pretty simple crate. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.predicates]] who = "Jan-Erik Rediger " criteria = "safe-to-run" @@ -1196,6 +1351,19 @@ criteria = "safe-to-deploy" delta = "1.0.40 -> 1.0.45" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" +[[audits.mozilla.audits.semver]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "1.0.16 -> 1.0.28" +notes = "Very few changes, mostly removes support for older Rust versions. Some unsafe code refactored, but it seemed to be functionally equivalent to me." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.semver]] +who = "Bobby Holley " +criteria = "safe-to-deploy" +delta = "1.0.17 -> 1.0.16" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.shlex]] who = "Max Inden " criteria = "safe-to-deploy" @@ -1214,18 +1382,6 @@ criteria = "safe-to-deploy" delta = "0.10.0 -> 0.11.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.strum]] -who = "Teodor Tanasoaia " -criteria = "safe-to-deploy" -delta = "0.25.0 -> 0.26.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.strum_macros]] -who = "Teodor Tanasoaia " -criteria = "safe-to-deploy" -delta = "0.25.3 -> 0.26.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " criteria = "safe-to-deploy" @@ -1259,3 +1415,21 @@ This code DOES contain unsafe code required to internally call volatiles for deleting data. This is expected and documented behavior. """ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.zmij]] +who = "Benjamin VanderSloot " +criteria = "safe-to-deploy" +version = "1.0.20" +notes = """ +A lot of unsafe code here, included as a dependency of serde_json. +The testing is very thorough, validating all 32-bit floats, and 100m +random 64-bit floats. No unsafe imports. +""" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.zmij]] +who = "Ben Dean-Kawamura " +criteria = "safe-to-deploy" +delta = "1.0.20 -> 1.0.21" +notes = "Almost no code changes. No new unsafe code." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"