2 # cargo-vet imports lock
4 [[unpublished.allocator-api2]]
8 [[publisher.aho-corasick]]
12 user-login = "BurntSushi"
13 user-name = "Andrew Gallant"
22 [[publisher.arbitrary]]
26 user-login = "fitzgen"
27 user-name = "Nick Fitzgerald"
29 [[publisher.async-trait]]
33 user-login = "dtolnay"
34 user-name = "David Tolnay"
40 user-login = "Amanieu"
41 user-name = "Amanieu d'Antras"
43 [[publisher.audio_thread_priority]]
47 user-login = "padenot"
48 user-name = "Paul Adenot"
50 [[publisher.authenticator]]
54 user-login = "jschanck"
55 user-name = "John Schanck"
61 user-login = "martinthomson"
62 user-name = "Martin Thomson"
64 [[publisher.breakpad-symbols]]
68 user-login = "gabrielesvelto"
69 user-name = "Gabriele Svelto"
75 user-login = "fitzgen"
76 user-name = "Nick Fitzgerald"
78 [[publisher.byteorder]]
82 user-login = "BurntSushi"
83 user-name = "Andrew Gallant"
89 user-login = "Darksonn"
90 user-name = "Alice Ryhl"
92 [[publisher.cachemap2]]
96 user-login = "afranchuk"
97 user-name = "Alex Franchuk"
103 user-login = "Amanieu"
104 user-name = "Amanieu d'Antras"
110 user-login = "emilio"
111 user-name = "Emilio Cobos Álvarez"
118 user-name = "Ed Page"
120 [[publisher.clap_derive]]
125 user-name = "Ed Page"
127 [[publisher.clap_lex]]
132 user-name = "Ed Page"
134 [[publisher.clubcard]]
138 user-login = "jschanck"
139 user-name = "John Schanck"
141 [[publisher.clubcard-crlite]]
145 user-login = "jschanck"
146 user-name = "John Schanck"
148 [[publisher.core-foundation]]
152 user-login = "jrmuizel"
153 user-name = "Jeff Muizelaar"
155 [[publisher.core-foundation-sys]]
159 user-login = "jrmuizel"
160 user-name = "Jeff Muizelaar"
162 [[publisher.core-graphics]]
166 user-login = "jrmuizel"
167 user-name = "Jeff Muizelaar"
169 [[publisher.core-graphics-types]]
174 user-name = "Josh Matthews"
176 [[publisher.core-text]]
180 user-login = "jrmuizel"
181 user-name = "Jeff Muizelaar"
183 [[publisher.derive_arbitrary]]
187 user-login = "fitzgen"
188 user-name = "Nick Fitzgerald"
194 user-login = "linabutler"
195 user-name = "Lina Butler"
201 user-login = "dtolnay"
202 user-name = "David Tolnay"
204 [[publisher.encoding_rs]]
208 user-login = "hsivonen"
209 user-name = "Henri Sivonen"
215 user-login = "sunfishcode"
216 user-name = "Dan Gohman"
218 [[publisher.etagere]]
223 user-name = "Nicolas Silva"
230 user-name = "Nicolas Silva"
236 user-login = "joshtriplett"
237 user-name = "Josh Triplett"
239 [[publisher.framehop]]
243 user-login = "mstange"
244 user-name = "Markus Stange"
246 [[publisher.freetype]]
251 user-name = "Josh Matthews"
257 user-login = "jrmuizel"
258 user-name = "Jeff Muizelaar"
264 user-login = "badboy"
265 user-name = "Jan-Erik Rediger"
267 [[publisher.glean-core]]
271 user-login = "badboy"
272 user-name = "Jan-Erik Rediger"
274 [[publisher.glslopt]]
278 user-login = "jamienicol"
279 user-name = "Jamie Nicol"
285 user-login = "seanmonstar"
286 user-name = "Sean McArthur"
288 [[publisher.hashbrown]]
292 user-login = "Amanieu"
293 user-name = "Amanieu d'Antras"
295 [[publisher.headers]]
299 user-login = "seanmonstar"
300 user-name = "Sean McArthur"
302 [[publisher.httparse]]
306 user-login = "seanmonstar"
307 user-name = "Sean McArthur"
309 [[publisher.indexmap]]
313 user-login = "cuviper"
314 user-name = "Josh Stone"
316 [[publisher.inherent]]
320 user-login = "dtolnay"
321 user-name = "David Tolnay"
323 [[publisher.io-surface]]
328 user-name = "Josh Matthews"
334 user-login = "carllerche"
335 user-name = "Carl Lerche"
341 user-login = "dtolnay"
342 user-name = "David Tolnay"
344 [[publisher.jobserver]]
348 user-login = "alexcrichton"
349 user-name = "Alex Crichton"
355 user-login = "JohnTitor"
356 user-name = "Yuki Okushi"
358 [[publisher.libz-rs-sys]]
362 user-login = "rnijveld"
363 user-name = "Ruben Nijveld"
365 [[publisher.linux-raw-sys]]
369 user-login = "sunfishcode"
370 user-name = "Dan Gohman"
372 [[publisher.lock_api]]
376 user-login = "Amanieu"
377 user-name = "Amanieu d'Antras"
379 [[publisher.macho-unwind-info]]
383 user-login = "mstange"
384 user-name = "Markus Stange"
390 user-login = "BurntSushi"
391 user-name = "Andrew Gallant"
397 user-login = "seanmonstar"
398 user-name = "Sean McArthur"
400 [[publisher.minidump]]
404 user-login = "gabrielesvelto"
405 user-name = "Gabriele Svelto"
407 [[publisher.minidump-common]]
411 user-login = "gabrielesvelto"
412 user-name = "Gabriele Svelto"
414 [[publisher.minidump-unwind]]
418 user-login = "gabrielesvelto"
419 user-name = "Gabriele Svelto"
421 [[publisher.nss-gk-api]]
425 user-login = "jschanck"
426 user-name = "John Schanck"
428 [[publisher.num_cpus]]
432 user-login = "seanmonstar"
433 user-name = "Sean McArthur"
439 user-login = "martinthomson"
440 user-name = "Martin Thomson"
442 [[publisher.ordered-float]]
446 user-login = "mbrubeck"
447 user-name = "Matt Brubeck"
449 [[publisher.parking_lot]]
453 user-login = "Amanieu"
454 user-name = "Amanieu d'Antras"
456 [[publisher.parking_lot_core]]
460 user-login = "Amanieu"
461 user-name = "Amanieu d'Antras"
467 user-login = "dtolnay"
468 user-name = "David Tolnay"
470 [[publisher.pe-unwind-info]]
474 user-login = "afranchuk"
475 user-name = "Alex Franchuk"
477 [[publisher.presser]]
481 user-login = "embark-studios"
487 user-login = "divviup-github-automation"
489 [[publisher.proc-macro2]]
493 user-login = "dtolnay"
494 user-name = "David Tolnay"
500 user-login = "jrmuizel"
501 user-name = "Jeff Muizelaar"
507 user-login = "dtolnay"
508 user-name = "David Tolnay"
514 user-login = "BurntSushi"
515 user-name = "Andrew Gallant"
517 [[publisher.regex-automata]]
521 user-login = "BurntSushi"
522 user-name = "Andrew Gallant"
524 [[publisher.regex-syntax]]
528 user-login = "BurntSushi"
529 user-name = "Andrew Gallant"
531 [[publisher.rust_cascade]]
535 user-login = "mozkeeler"
536 user-name = "Dana Keeler"
542 user-login = "sunfishcode"
543 user-name = "Dan Gohman"
549 user-login = "dtolnay"
550 user-name = "David Tolnay"
552 [[publisher.same-file]]
556 user-login = "BurntSushi"
557 user-name = "Andrew Gallant"
559 [[publisher.scopeguard]]
563 user-login = "Amanieu"
564 user-name = "Amanieu d'Antras"
570 user-login = "dtolnay"
571 user-name = "David Tolnay"
573 [[publisher.serde_bytes]]
577 user-login = "dtolnay"
578 user-name = "David Tolnay"
580 [[publisher.serde_derive]]
584 user-login = "dtolnay"
585 user-name = "David Tolnay"
587 [[publisher.serde_json]]
591 user-login = "dtolnay"
592 user-name = "David Tolnay"
594 [[publisher.serde_repr]]
598 user-login = "dtolnay"
599 user-name = "David Tolnay"
601 [[publisher.serde_yaml]]
605 user-login = "dtolnay"
606 user-name = "David Tolnay"
608 [[publisher.smallvec]]
612 user-login = "mbrubeck"
613 user-name = "Matt Brubeck"
619 user-login = "dtolnay"
620 user-name = "David Tolnay"
622 [[publisher.termcolor]]
626 user-login = "BurntSushi"
627 user-name = "Andrew Gallant"
629 [[publisher.thiserror]]
633 user-login = "dtolnay"
634 user-name = "David Tolnay"
636 [[publisher.thiserror-impl]]
640 user-login = "dtolnay"
641 user-name = "David Tolnay"
643 [[publisher.threadbound]]
647 user-login = "dtolnay"
648 user-name = "David Tolnay"
654 user-login = "Darksonn"
655 user-name = "Alice Ryhl"
657 [[publisher.tokio-macros]]
661 user-login = "Darksonn"
662 user-name = "Alice Ryhl"
664 [[publisher.tokio-util]]
668 user-login = "Darksonn"
669 user-name = "Alice Ryhl"
675 user-login = "alexcrichton"
676 user-name = "Alex Crichton"
678 [[publisher.unicode-ident]]
682 user-login = "dtolnay"
683 user-name = "David Tolnay"
685 [[publisher.unicode-width]]
689 user-login = "Manishearth"
690 user-name = "Manish Goregaokar"
692 [[publisher.unicode-xid]]
696 user-login = "Manishearth"
697 user-name = "Manish Goregaokar"
705 [[publisher.uniffi_bindgen]]
711 [[publisher.uniffi_build]]
717 [[publisher.uniffi_checksum_derive]]
723 [[publisher.uniffi_core]]
729 [[publisher.uniffi_macros]]
735 [[publisher.uniffi_meta]]
741 [[publisher.uniffi_testing]]
747 [[publisher.uniffi_udl]]
753 [[publisher.utf8_iter]]
757 user-login = "hsivonen"
758 user-name = "Henri Sivonen"
760 [[publisher.walkdir]]
764 user-login = "BurntSushi"
765 user-name = "Andrew Gallant"
771 user-login = "seanmonstar"
772 user-name = "Sean McArthur"
775 version = "0.11.0+wasi-snapshot-preview1"
778 user-login = "alexcrichton"
779 user-name = "Alex Crichton"
781 [[publisher.wasm-encoder]]
785 user-login = "wasmtime-publish"
787 [[publisher.wasm-smith]]
791 user-login = "wasmtime-publish"
793 [[publisher.wasmparser]]
797 user-login = "wasmtime-publish"
803 user-login = "wasmtime-publish"
805 [[publisher.weedle2]]
811 [[publisher.winapi-util]]
815 user-login = "BurntSushi"
816 user-name = "Andrew Gallant"
818 [[publisher.windows]]
822 user-login = "kennykerr"
823 user-name = "Kenny Kerr"
825 [[publisher.windows-core]]
829 user-login = "kennykerr"
830 user-name = "Kenny Kerr"
832 [[publisher.windows-implement]]
836 user-login = "kennykerr"
837 user-name = "Kenny Kerr"
839 [[publisher.windows-interface]]
843 user-login = "kennykerr"
844 user-name = "Kenny Kerr"
846 [[publisher.windows-result]]
850 user-login = "kennykerr"
851 user-name = "Kenny Kerr"
853 [[publisher.windows-strings]]
857 user-login = "kennykerr"
858 user-name = "Kenny Kerr"
860 [[publisher.windows-sys]]
864 user-login = "kennykerr"
865 user-name = "Kenny Kerr"
867 [[publisher.zeitstempel]]
871 user-login = "badboy"
872 user-name = "Jan-Erik Rediger"
874 [[publisher.zlib-rs]]
878 user-login = "rnijveld"
879 user-name = "Ruben Nijveld"
881 [[audits.bytecode-alliance.wildcard-audits.arbitrary]]
882 who = "Nick Fitzgerald <fitzgen@gmail.com>"
883 criteria = "safe-to-deploy"
884 user-id = 696 # Nick Fitzgerald (fitzgen)
887 notes = "I am an author of this crate."
889 [[audits.bytecode-alliance.wildcard-audits.bumpalo]]
890 who = "Nick Fitzgerald <fitzgen@gmail.com>"
891 criteria = "safe-to-deploy"
892 user-id = 696 # Nick Fitzgerald (fitzgen)
896 [[audits.bytecode-alliance.wildcard-audits.derive_arbitrary]]
897 who = "Nick Fitzgerald <fitzgen@gmail.com>"
898 criteria = "safe-to-deploy"
899 user-id = 696 # Nick Fitzgerald (fitzgen)
902 notes = "I am an author of this crate"
904 [[audits.bytecode-alliance.wildcard-audits.wasm-encoder]]
905 who = "Alex Crichton <alex@alexcrichton.com>"
906 criteria = "safe-to-deploy"
907 user-id = 73222 # wasmtime-publish
911 The Bytecode Alliance uses the `wasmtime-publish` crates.io account to automate
912 publication of this crate from CI. This repository requires all PRs are reviewed
913 by a Bytecode Alliance maintainer and it owned by the Bytecode Alliance itself.
916 [[audits.bytecode-alliance.wildcard-audits.wasmparser]]
917 who = "Alex Crichton <alex@alexcrichton.com>"
918 criteria = "safe-to-deploy"
919 user-id = 73222 # wasmtime-publish
923 The Bytecode Alliance uses the `wasmtime-publish` crates.io account to automate
924 publication of this crate from CI. This repository requires all PRs are reviewed
925 by a Bytecode Alliance maintainer and it owned by the Bytecode Alliance itself.
928 [[audits.bytecode-alliance.wildcard-audits.wast]]
929 who = "Alex Crichton <alex@alexcrichton.com>"
930 criteria = "safe-to-deploy"
931 user-id = 73222 # wasmtime-publish
935 The Bytecode Alliance uses the `wasmtime-publish` crates.io account to automate
936 publication of this crate from CI. This repository requires all PRs are reviewed
937 by a Bytecode Alliance maintainer and it owned by the Bytecode Alliance itself.
940 [[audits.bytecode-alliance.audits.adler]]
941 who = "Alex Crichton <alex@alexcrichton.com>"
942 criteria = "safe-to-deploy"
944 notes = "This is a small crate which forbids unsafe code and is a straightforward implementation of the adler hashing algorithm."
946 [[audits.bytecode-alliance.audits.ahash]]
947 who = "Chris Fallin <chris@cfallin.org>"
948 criteria = "safe-to-deploy"
949 delta = "0.7.6 -> 0.8.2"
951 [[audits.bytecode-alliance.audits.ahash]]
952 who = "Alex Crichton <alex@alexcrichton.com>"
953 criteria = "safe-to-deploy"
954 delta = "0.8.2 -> 0.8.7"
956 Shuffling of features in this update and while there are updates to `unsafe`
957 code it's no different than before and the usage remains the same.
960 [[audits.bytecode-alliance.audits.arrayref]]
961 who = "Nick Fitzgerald <fitzgen@gmail.com>"
962 criteria = "safe-to-deploy"
965 Unsafe code, but its logic looks good to me. Necessary given what it is
966 doing. Well tested, has quickchecks.
969 [[audits.bytecode-alliance.audits.arrayvec]]
970 who = "Nick Fitzgerald <fitzgen@gmail.com>"
971 criteria = "safe-to-deploy"
974 Well documented invariants, good assertions for those invariants in unsafe code,
975 and tested with MIRI to boot. LGTM.
978 [[audits.bytecode-alliance.audits.base64]]
979 who = "Pat Hickey <phickey@fastly.com>"
980 criteria = "safe-to-deploy"
982 notes = "This crate has no dependencies, no build.rs, and contains no unsafe code."
984 [[audits.bytecode-alliance.audits.block-buffer]]
985 who = "Benjamin Bouvier <public@benj.me>"
986 criteria = "safe-to-deploy"
987 delta = "0.9.0 -> 0.10.2"
989 [[audits.bytecode-alliance.audits.cargo-platform]]
990 who = "Pat Hickey <phickey@fastly.com>"
991 criteria = "safe-to-deploy"
993 notes = "no build, no ambient capabilities, no unsafe"
995 [[audits.bytecode-alliance.audits.cfg-if]]
996 who = "Alex Crichton <alex@alexcrichton.com>"
997 criteria = "safe-to-deploy"
999 notes = "I am the author of this crate."
1001 [[audits.bytecode-alliance.audits.codespan-reporting]]
1002 who = "Jamey Sharp <jsharp@fastly.com>"
1003 criteria = "safe-to-deploy"
1005 notes = "This library uses `forbid(unsafe_code)` and has no filesystem or network I/O."
1007 [[audits.bytecode-alliance.audits.core-foundation-sys]]
1008 who = "Dan Gohman <dev@sunfishcode.online>"
1009 criteria = "safe-to-deploy"
1010 delta = "0.8.4 -> 0.8.6"
1012 The changes here are all typical bindings updates: new functions, types, and
1013 constants. I have not audited all the bindings for ABI conformance.
1016 [[audits.bytecode-alliance.audits.cpufeatures]]
1017 who = "Alex Crichton <alex@alexcrichton.com>"
1018 criteria = "safe-to-deploy"
1019 delta = "0.2.2 -> 0.2.7"
1021 This is a minor update that looks to add some more detected CPU features and
1022 various other minor portability fixes such as MIRI support.
1025 [[audits.bytecode-alliance.audits.crossbeam-channel]]
1026 who = "Alex Crichton <alex@alexcrichton.com>"
1027 criteria = "safe-to-deploy"
1028 delta = "0.5.4 -> 0.5.8"
1030 This diff does what it says on the tin for this version range, notably fixing a
1031 race condition, improving handling of durations, and additionally swapping out a
1032 spin lock with a lock from the standard library. Minor bits of `unsafe` code
1033 are modified but that's expected given the nature of this crate.
1036 [[audits.bytecode-alliance.audits.crypto-common]]
1037 who = "Benjamin Bouvier <public@benj.me>"
1038 criteria = "safe-to-deploy"
1041 [[audits.bytecode-alliance.audits.fallible-iterator]]
1042 who = "Alex Crichton <alex@alexcrichton.com>"
1043 criteria = "safe-to-deploy"
1044 delta = "0.2.0 -> 0.3.0"
1046 This major version update has a few minor breaking changes but everything
1047 this crate has to do with iterators and `Result` and such. No `unsafe` or
1048 anything like that, all looks good.
1051 [[audits.bytecode-alliance.audits.fastrand]]
1052 who = "Alex Crichton <alex@alexcrichton.com>"
1053 criteria = "safe-to-deploy"
1054 delta = "2.0.0 -> 2.0.1"
1056 This update had a few doc updates but no otherwise-substantial source code
1060 [[audits.bytecode-alliance.audits.flate2]]
1061 who = "Andrew Brown <andrew.brown@intel.com>"
1062 criteria = "safe-to-deploy"
1063 delta = "1.0.26 -> 1.0.28"
1064 notes = "No new `unsafe` and no large changes in function. This diff is mostly refactoring with a lot of docs, CI, test changes. Adds some defensive clearing out of certain variables as a safeguard."
1066 [[audits.bytecode-alliance.audits.foreign-types]]
1067 who = "Pat Hickey <phickey@fastly.com>"
1068 criteria = "safe-to-deploy"
1070 notes = "This crate defined a macro-rules which creates wrappers working with FFI types. The implementation of this crate appears to be safe, but each use of this macro would need to be vetted for correctness as well."
1072 [[audits.bytecode-alliance.audits.foreign-types-shared]]
1073 who = "Pat Hickey <phickey@fastly.com>"
1074 criteria = "safe-to-deploy"
1077 [[audits.bytecode-alliance.audits.futures-channel]]
1078 who = "Pat Hickey <phickey@fastly.com>"
1079 criteria = "safe-to-deploy"
1081 notes = "build.rs is just detecting the target and setting cfg. unsafety is for implementing a concurrency primitives using atomics and unsafecell, and is not obviously incorrect (this is the sort of thing I wouldn't certify as correct without formal methods)"
1083 [[audits.bytecode-alliance.audits.futures-core]]
1084 who = "Pat Hickey <phickey@fastly.com>"
1085 criteria = "safe-to-deploy"
1087 notes = "Unsafe used to implement a concurrency primitive AtomicWaker. Well-commented and not obviously incorrect. Like my other audits of these concurrency primitives inside the futures family, I couldn't certify that it is correct without formal methods, but that is out of scope for this vetting."
1089 [[audits.bytecode-alliance.audits.futures-executor]]
1090 who = "Pat Hickey <phickey@fastly.com>"
1091 criteria = "safe-to-deploy"
1093 notes = "Unsafe used to implement the unpark mutex, which is well commented and not obviously incorrect. Like with futures-channel I wouldn't be able to certify it as correct without formal methods."
1095 [[audits.bytecode-alliance.audits.futures-io]]
1096 who = "Pat Hickey <phickey@fastly.com>"
1097 criteria = "safe-to-deploy"
1100 [[audits.bytecode-alliance.audits.futures-sink]]
1101 who = "Pat Hickey <phickey@fastly.com>"
1102 criteria = "safe-to-deploy"
1105 [[audits.bytecode-alliance.audits.heck]]
1106 who = "Alex Crichton <alex@alexcrichton.com>"
1107 criteria = "safe-to-deploy"
1108 delta = "0.4.1 -> 0.5.0"
1109 notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected."
1111 [[audits.bytecode-alliance.audits.id-arena]]
1112 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1113 criteria = "safe-to-deploy"
1115 notes = "I am the author of this crate."
1117 [[audits.bytecode-alliance.audits.idna]]
1118 who = "Alex Crichton <alex@alexcrichton.com>"
1119 criteria = "safe-to-deploy"
1122 This is a crate without unsafe code or usage of the standard library. The large
1123 size of this crate comes from the large generated unicode tables file. This
1124 crate is broadly used throughout the ecosystem and does not contain anything
1128 [[audits.bytecode-alliance.audits.leb128]]
1129 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1130 criteria = "safe-to-deploy"
1132 notes = "I am the author of this crate."
1134 [[audits.bytecode-alliance.audits.memoffset]]
1135 who = "Alex Crichton <alex@alexcrichton.com>"
1136 criteria = "safe-to-deploy"
1137 delta = "0.7.1 -> 0.8.0"
1138 notes = "This was a small update to the crate which has to do with Rust language features and compiler versions, no substantial changes."
1140 [[audits.bytecode-alliance.audits.miniz_oxide]]
1141 who = "Alex Crichton <alex@alexcrichton.com>"
1142 criteria = "safe-to-deploy"
1145 This crate is a Rust implementation of zlib compression/decompression and has
1146 been used by default by the Rust standard library for quite some time. It's also
1147 a default dependency of the popular `backtrace` crate for decompressing debug
1148 information. This crate forbids unsafe code and does not otherwise access system
1149 resources. It's originally a port of the `miniz.c` library as well, and given
1150 its own longevity should be relatively hardened against some of the more common
1151 compression-related issues.
1154 [[audits.bytecode-alliance.audits.mio]]
1155 who = "Alex Crichton <alex@alexcrichton.com>"
1156 criteria = "safe-to-deploy"
1157 delta = "0.8.6 -> 0.8.8"
1158 notes = "Mostly OS portability updates along with some minor bugfixes."
1160 [[audits.bytecode-alliance.audits.num-traits]]
1161 who = "Andrew Brown <andrew.brown@intel.com>"
1162 criteria = "safe-to-deploy"
1164 notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected."
1166 [[audits.bytecode-alliance.audits.object]]
1167 who = "Alex Crichton <alex@alexcrichton.com>"
1168 criteria = "safe-to-deploy"
1169 delta = "0.30.3 -> 0.31.1"
1170 notes = "A large-ish update to the crate but nothing out of the ordering. Support for new formats like xcoff, new constants, minor refactorings, etc. Nothing out of the ordinary."
1172 [[audits.bytecode-alliance.audits.object]]
1173 who = "Alex Crichton <alex@alexcrichton.com>"
1174 criteria = "safe-to-deploy"
1175 delta = "0.31.1 -> 0.32.0"
1176 notes = "Various new features and refactorings as one would expect from an object parsing crate, all looks good."
1178 [[audits.bytecode-alliance.audits.object]]
1179 who = "Alex Crichton <alex@alexcrichton.com>"
1180 criteria = "safe-to-deploy"
1181 delta = "0.32.0 -> 0.33.0"
1183 No `unsafe` code in this update. Lots of changes but all
1184 object-file-format-related, everything looks good.
1187 [[audits.bytecode-alliance.audits.percent-encoding]]
1188 who = "Alex Crichton <alex@alexcrichton.com>"
1189 criteria = "safe-to-deploy"
1192 This crate is a single-file crate that does what it says on the tin. There are
1193 a few `unsafe` blocks related to utf-8 validation which are locally verifiable
1194 as correct and otherwise this crate is good to go.
1197 [[audits.bytecode-alliance.audits.pin-utils]]
1198 who = "Pat Hickey <phickey@fastly.com>"
1199 criteria = "safe-to-deploy"
1202 [[audits.bytecode-alliance.audits.pkg-config]]
1203 who = "Pat Hickey <phickey@fastly.com>"
1204 criteria = "safe-to-deploy"
1206 notes = "This crate shells out to the pkg-config executable, but it appears to sanitize inputs reasonably."
1208 [[audits.bytecode-alliance.audits.rustc-demangle]]
1209 who = "Alex Crichton <alex@alexcrichton.com>"
1210 criteria = "safe-to-deploy"
1212 notes = "I am the author of this crate."
1214 [[audits.bytecode-alliance.audits.semver]]
1215 who = "Pat Hickey <phickey@fastly.com>"
1216 criteria = "safe-to-deploy"
1218 notes = "plenty of unsafe pointer and vec tricks, but in well-structured and commented code that appears to be correct"
1220 [[audits.bytecode-alliance.audits.slab]]
1221 who = "Pat Hickey <phickey@fastly.com>"
1222 criteria = "safe-to-deploy"
1224 notes = "provides a datastructure implemented using std's Vec. all uses of unsafe are just delegating to the underlying unsafe Vec methods."
1226 [[audits.bytecode-alliance.audits.tempfile]]
1227 who = "Pat Hickey <phickey@fastly.com>"
1228 criteria = "safe-to-deploy"
1229 delta = "3.3.0 -> 3.5.0"
1231 [[audits.bytecode-alliance.audits.tempfile]]
1232 who = "Alex Crichton <alex@alexcrichton.com>"
1233 criteria = "safe-to-deploy"
1234 delta = "3.5.0 -> 3.6.0"
1235 notes = "Dependency updates and new optimized trait implementations, but otherwise everything looks normal."
1237 [[audits.bytecode-alliance.audits.unicase]]
1238 who = "Alex Crichton <alex@alexcrichton.com>"
1239 criteria = "safe-to-deploy"
1242 This crate contains no `unsafe` code and no unnecessary use of the standard
1246 [[audits.bytecode-alliance.audits.unicode-bidi]]
1247 who = "Alex Crichton <alex@alexcrichton.com>"
1248 criteria = "safe-to-deploy"
1251 This crate has no unsafe code and does not use `std::*`. Skimming the crate it
1252 does not attempt to out of the bounds of what it's already supposed to be doing.
1255 [[audits.embark-studios.wildcard-audits.presser]]
1256 who = "Gray Olson <opensource@embark-studios.com>"
1257 criteria = "safe-to-deploy"
1258 user-id = 52553 # embark-studios
1259 start = "2021-01-01"
1262 Small crate with no dependencies and no ambient capabilities. The safe interface of the crate
1263 is gated behind unsafe implementation of a core trait, and care must be taken to ensure that
1264 the relevant invariants are guaranteed when doing so. Maintained by the Ark team at Embark
1265 and used in production.
1268 [[audits.embark-studios.audits.anyhow]]
1269 who = "Johan Andersson <opensource@embark-studios.com>"
1270 criteria = "safe-to-deploy"
1273 [[audits.embark-studios.audits.cfg_aliases]]
1274 who = "Johan Andersson <opensource@embark-studios.com>"
1275 criteria = "safe-to-deploy"
1277 notes = "No unsafe usage or ambient capabilities"
1279 [[audits.embark-studios.audits.derive_more]]
1280 who = "Johan Andersson <opensource@embark-studios.com>"
1281 criteria = "safe-to-deploy"
1283 notes = "No unsafe usage or ambient capabilities"
1285 [[audits.embark-studios.audits.ident_case]]
1286 who = "Johan Andersson <opensource@embark-studios.com>"
1287 criteria = "safe-to-deploy"
1289 notes = "No unsafe usage or ambient capabilities"
1291 [[audits.embark-studios.audits.idna]]
1292 who = "Johan Andersson <opensource@embark-studios.com>"
1293 criteria = "safe-to-deploy"
1294 delta = "0.3.0 -> 0.4.0"
1295 notes = "No unsafe usage or ambient capabilities"
1297 [[audits.embark-studios.audits.line-wrap]]
1298 who = "Johan Andersson <opensource@embark-studios.com>"
1299 criteria = "safe-to-deploy"
1301 notes = "No unsafe usage or ambient capabilities"
1303 [[audits.embark-studios.audits.yaml-rust]]
1304 who = "Johan Andersson <opensource@embark-studios.com>"
1305 criteria = "safe-to-deploy"
1307 notes = "No unsafe usage or ambient capabilities"
1309 [[audits.google.audits.ash]]
1310 who = "David Koloski <dkoloski@google.com>"
1311 criteria = "safe-to-deploy"
1312 version = "0.37.0+1.3.209"
1313 notes = "Reviewed on https://fxrev.dev/694269"
1314 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1316 [[audits.google.audits.bitflags]]
1317 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1318 criteria = "safe-to-deploy"
1323 * I've checked for any discussion in Google-internal cl/546819168 (where audit
1324 of version 2.3.3 happened)
1325 * `src/lib.rs` contains `#![cfg_attr(not(test), forbid(unsafe_code))]`
1326 * There are 2 cases of `unsafe` in `src/external.rs` but they seem to be
1327 correct in a straightforward way - they just propagate the marker trait's
1328 impl (e.g. `impl bytemuck::Pod`) from the inner to the outer type
1329 * Additional discussion and/or notes may be found in https://crrev.com/c/5238056
1331 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1333 [[audits.google.audits.bitflags]]
1334 who = "Adrian Taylor <adetaylor@chromium.org>"
1335 criteria = "safe-to-deploy"
1336 delta = "2.4.2 -> 2.5.0"
1337 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1339 [[audits.google.audits.bitflags]]
1340 who = "Adrian Taylor <adetaylor@chromium.org>"
1341 criteria = "safe-to-deploy"
1342 delta = "2.5.0 -> 2.6.0"
1343 notes = "The changes from the previous version are negligible and thus it retains the same properties."
1344 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1346 [[audits.google.audits.clap_builder]]
1347 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1348 criteria = "safe-to-deploy"
1351 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
1352 and there were no hits.
1354 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1356 [[audits.google.audits.crc32fast]]
1357 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1358 criteria = "safe-to-deploy"
1361 Security review of earlier versions of the crate can be found at
1362 (Google-internal, sorry): go/image-crate-chromium-security-review
1364 Audit comments for 1.4.2 can be found at https://crrev.com/c/4723145.
1366 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1368 [[audits.google.audits.equivalent]]
1369 who = "George Burgess IV <gbiv@google.com>"
1370 criteria = "safe-to-deploy"
1372 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1374 [[audits.google.audits.fastrand]]
1375 who = "George Burgess IV <gbiv@google.com>"
1376 criteria = "safe-to-deploy"
1379 `does-not-implement-crypto` is certified because this crate explicitly says
1380 that the RNG here is not cryptographically secure.
1382 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1384 [[audits.google.audits.futures]]
1385 who = "George Burgess IV <gbiv@google.com>"
1386 criteria = "safe-to-deploy"
1389 `futures` has no logic other than tests - it simply `pub use`s things from
1392 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1394 [[audits.google.audits.glob]]
1395 who = "George Burgess IV <gbiv@google.com>"
1396 criteria = "safe-to-deploy"
1398 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1400 [[audits.google.audits.heck]]
1401 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1402 criteria = "safe-to-deploy"
1405 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
1406 and there were no hits.
1408 `heck` (version `0.3.3`) has been added to Chromium in
1409 https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
1411 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1413 [[audits.google.audits.http]]
1415 criteria = "safe-to-run"
1417 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1419 [[audits.google.audits.http-body]]
1421 criteria = "safe-to-run"
1423 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1425 [[audits.google.audits.httpdate]]
1427 criteria = "safe-to-run"
1429 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1431 [[audits.google.audits.hyper]]
1433 criteria = "safe-to-run"
1435 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1437 [[audits.google.audits.nom]]
1438 who = "danakj@chromium.org"
1439 criteria = "safe-to-deploy"
1442 Reviewed in https://chromium-review.googlesource.com/c/chromium/src/+/5046153
1444 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1446 [[audits.google.audits.pin-project]]
1448 criteria = "safe-to-run"
1450 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1452 [[audits.google.audits.pin-project-internal]]
1454 criteria = "safe-to-run"
1456 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1458 [[audits.google.audits.pin-project-lite]]
1459 who = "David Koloski <dkoloski@google.com>"
1460 criteria = "safe-to-deploy"
1462 notes = "Reviewed on https://fxrev.dev/824504"
1463 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1465 [[audits.google.audits.pin-project-lite]]
1466 who = "David Koloski <dkoloski@google.com>"
1467 criteria = "safe-to-deploy"
1468 delta = "0.2.9 -> 0.2.13"
1469 notes = "Audited at https://fxrev.dev/946396"
1470 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1472 [[audits.google.audits.proc-macro2]]
1473 who = "danakj@chromium.org"
1474 criteria = "safe-to-deploy"
1475 delta = "1.0.84 -> 1.0.85"
1476 notes = "Test-only changes."
1477 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1479 [[audits.google.audits.proc-macro2]]
1480 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1481 criteria = "safe-to-deploy"
1482 delta = "1.0.85 -> 1.0.86"
1484 Comment-only changes in `build.rs`.
1485 Reordering of `Cargo.toml` entries.
1486 Just bumping up the version number in `lib.rs`.
1487 Config-related changes in `test_size.rs`.
1489 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1491 [[audits.google.audits.scoped-tls]]
1492 who = "George Burgess IV <gbiv@google.com>"
1493 criteria = "safe-to-run"
1495 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1497 [[audits.google.audits.serde_urlencoded]]
1499 criteria = "safe-to-run"
1501 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1503 [[audits.google.audits.socket2]]
1504 who = "David Koloski <dkoloski@google.com>"
1505 criteria = "safe-to-deploy"
1506 delta = "0.4.4 -> 0.5.5"
1507 notes = "Reviewed at https://fxrev.dev/946307"
1508 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1510 [[audits.google.audits.static_assertions]]
1511 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1512 criteria = "safe-to-deploy"
1515 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
1516 and there were no hits except for one `unsafe`.
1518 The lambda where `unsafe` is used is never invoked (e.g. the `unsafe` code
1519 never runs) and is only introduced for some compile-time checks. Additional
1520 unsafe review comments can be found in https://crrev.com/c/5353376.
1522 This crate has been added to Chromium in https://crrev.com/c/3736562. The CL
1523 description contains a link to a document with an additional security review.
1525 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1527 [[audits.google.audits.strsim]]
1528 who = "danakj@chromium.org"
1529 criteria = "safe-to-deploy"
1532 Reviewed in https://crrev.com/c/5171063
1534 Previously reviewed during security review and the audit is grandparented in.
1536 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1538 [[audits.google.audits.tokio-stream]]
1539 who = "David Koloski <dkoloski@google.com>"
1540 criteria = "safe-to-deploy"
1542 notes = "Reviewed on https://fxrev.dev/804724"
1543 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1545 [[audits.google.audits.tower-service]]
1547 criteria = "safe-to-run"
1549 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1551 [[audits.google.audits.try-lock]]
1553 criteria = "safe-to-run"
1555 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1557 [[audits.google.audits.unicode-linebreak]]
1558 who = "Lukasz Anforowicz <lukasza@chromium.org>"
1559 criteria = "safe-to-deploy"
1562 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
1563 and there were no hits.
1565 Version `0.1.2` of this crate has been added to Chromium in
1566 https://source.chromium.org/chromium/chromium/src/+/591a0f30c5eac93b6a3d981c2714ffa4db28dbcb
1567 The CL description contains a link to a Google-internal document with audit details.
1569 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
1571 [[audits.google.audits.version_check]]
1572 who = "George Burgess IV <gbiv@google.com>"
1573 criteria = "safe-to-deploy"
1575 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1577 [[audits.google.audits.want]]
1579 criteria = "safe-to-run"
1581 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1583 [[audits.isrg.wildcard-audits.prio]]
1584 who = "David Cook <dcook@divviup.org>"
1585 criteria = "safe-to-deploy"
1586 user-id = 213776 # divviup-github-automation
1587 start = "2020-09-28"
1590 [[audits.isrg.audits.base64]]
1591 who = "Tim Geoghegan <timg@letsencrypt.org>"
1592 criteria = "safe-to-deploy"
1593 delta = "0.21.0 -> 0.21.1"
1595 [[audits.isrg.audits.base64]]
1596 who = "Brandon Pitman <bran@bran.land>"
1597 criteria = "safe-to-deploy"
1598 delta = "0.21.1 -> 0.21.2"
1600 [[audits.isrg.audits.base64]]
1601 who = "David Cook <dcook@divviup.org>"
1602 criteria = "safe-to-deploy"
1603 delta = "0.21.2 -> 0.21.3"
1605 [[audits.isrg.audits.block-buffer]]
1606 who = "David Cook <dcook@divviup.org>"
1607 criteria = "safe-to-deploy"
1610 [[audits.isrg.audits.digest]]
1611 who = "David Cook <dcook@divviup.org>"
1612 criteria = "safe-to-deploy"
1613 delta = "0.10.6 -> 0.10.7"
1615 [[audits.isrg.audits.getrandom]]
1616 who = "Tim Geoghegan <timg@letsencrypt.org>"
1617 criteria = "safe-to-deploy"
1618 delta = "0.2.9 -> 0.2.10"
1619 notes = "These changes include some new `unsafe` code for the `emscripten` and `psvita` targets, but all it does is call `libc::getentropy`."
1621 [[audits.isrg.audits.getrandom]]
1622 who = "David Cook <dcook@divviup.org>"
1623 criteria = "safe-to-deploy"
1624 delta = "0.2.11 -> 0.2.12"
1626 [[audits.isrg.audits.getrandom]]
1627 who = "David Cook <dcook@divviup.org>"
1628 criteria = "safe-to-deploy"
1629 delta = "0.2.12 -> 0.2.14"
1631 [[audits.isrg.audits.keccak]]
1632 who = "David Cook <dcook@divviup.org>"
1633 criteria = "safe-to-deploy"
1636 [[audits.isrg.audits.keccak]]
1637 who = "Brandon Pitman <bran@bran.land>"
1638 criteria = "safe-to-deploy"
1639 delta = "0.1.3 -> 0.1.4"
1641 [[audits.isrg.audits.once_cell]]
1642 who = "Brandon Pitman <bran@bran.land>"
1643 criteria = "safe-to-deploy"
1644 delta = "1.17.1 -> 1.17.2"
1646 [[audits.isrg.audits.once_cell]]
1647 who = "David Cook <dcook@divviup.org>"
1648 criteria = "safe-to-deploy"
1649 delta = "1.17.2 -> 1.18.0"
1651 [[audits.isrg.audits.once_cell]]
1652 who = "Brandon Pitman <bran@bran.land>"
1653 criteria = "safe-to-deploy"
1654 delta = "1.18.0 -> 1.19.0"
1656 [[audits.isrg.audits.once_cell]]
1657 who = "David Cook <dcook@divviup.org>"
1658 criteria = "safe-to-deploy"
1659 delta = "1.19.0 -> 1.20.1"
1661 [[audits.isrg.audits.rand_chacha]]
1662 who = "David Cook <dcook@divviup.org>"
1663 criteria = "safe-to-deploy"
1666 [[audits.isrg.audits.rand_core]]
1667 who = "David Cook <dcook@divviup.org>"
1668 criteria = "safe-to-deploy"
1671 [[audits.isrg.audits.rayon-core]]
1672 who = "Brandon Pitman <bran@bran.land>"
1673 criteria = "safe-to-deploy"
1674 delta = "1.10.2 -> 1.11.0"
1676 [[audits.isrg.audits.rayon-core]]
1677 who = "David Cook <dcook@divviup.org>"
1678 criteria = "safe-to-deploy"
1679 delta = "1.11.0 -> 1.12.0"
1681 [[audits.isrg.audits.sha2]]
1682 who = "David Cook <dcook@divviup.org>"
1683 criteria = "safe-to-deploy"
1686 [[audits.isrg.audits.sha3]]
1687 who = "David Cook <dcook@divviup.org>"
1688 criteria = "safe-to-deploy"
1691 [[audits.isrg.audits.sha3]]
1692 who = "Brandon Pitman <bran@bran.land>"
1693 criteria = "safe-to-deploy"
1694 delta = "0.10.7 -> 0.10.8"
1696 [[audits.mozilla.wildcard-audits.weedle2]]
1697 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1698 criteria = "safe-to-deploy"
1699 user-id = 127697 # bendk
1700 start = "2022-06-16"
1702 notes = "Maintained by Mozilla"
1703 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1705 [[audits.mozilla.wildcard-audits.zeitstempel]]
1706 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1707 criteria = "safe-to-deploy"
1708 user-id = 48 # Jan-Erik Rediger (badboy)
1709 start = "2021-03-03"
1711 notes = "Maintained by me"
1712 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1714 [[audits.mozilla.audits.askama]]
1715 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1716 criteria = "safe-to-deploy"
1717 delta = "0.11.1 -> 0.12.0"
1718 notes = "No new unsafe usage, mostly dependency updates and smaller API changes"
1719 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1721 [[audits.mozilla.audits.askama_derive]]
1722 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1723 criteria = "safe-to-deploy"
1724 delta = "0.11.2 -> 0.12.1"
1725 notes = "Dependency updates, a new toml dependency and some API changes. No unsafe use."
1726 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1728 [[audits.mozilla.audits.basic-toml]]
1729 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1730 criteria = "safe-to-deploy"
1732 notes = "TOML parser, forked from toml 0.5"
1733 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1735 [[audits.mozilla.audits.crossbeam-channel]]
1736 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1737 criteria = "safe-to-deploy"
1738 delta = "0.5.8 -> 0.5.11"
1739 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1741 [[audits.mozilla.audits.crossbeam-channel]]
1742 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1743 criteria = "safe-to-deploy"
1744 delta = "0.5.11 -> 0.5.12"
1745 notes = "Minimal change fixing a memory leak."
1746 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1748 [[audits.mozilla.audits.crossbeam-utils]]
1749 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1750 criteria = "safe-to-deploy"
1751 delta = "0.8.14 -> 0.8.19"
1752 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1754 [[audits.mozilla.audits.either]]
1755 who = "Nika Layzell <nika@thelayzells.com>"
1756 criteria = "safe-to-deploy"
1759 Straightforward crate providing the Either enum and trait implementations with
1762 aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
1764 [[audits.mozilla.audits.lazy_static]]
1765 who = "Nika Layzell <nika@thelayzells.com>"
1766 criteria = "safe-to-deploy"
1768 notes = "I have read over the macros, and audited the unsafe code."
1769 aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
1771 [[audits.mozilla.audits.log]]
1772 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1773 criteria = "safe-to-deploy"
1774 delta = "0.4.17 -> 0.4.18"
1775 notes = "One dependency removed, others updated (which we don't rely on), some APIs (which we don't use) changed."
1776 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1778 [[audits.mozilla.audits.log]]
1779 who = "Kagami Sascha Rosylight <krosylight@mozilla.com>"
1780 criteria = "safe-to-deploy"
1781 delta = "0.4.18 -> 0.4.20"
1782 notes = "Only cfg attribute and internal macro changes and module refactorings"
1783 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1785 [[audits.mozilla.audits.rkv]]
1786 who = "Kagami Sascha Rosylight <krosylight@mozilla.com>"
1787 criteria = "safe-to-deploy"
1788 delta = "0.18.4 -> 0.19.0"
1789 notes = "Maintained by Mozilla, no addition of unsafe blocks"
1790 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1792 [[audits.mozilla.audits.scroll]]
1793 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1794 criteria = "safe-to-deploy"
1795 delta = "0.11.0 -> 0.12.0"
1796 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1798 [[audits.mozilla.audits.scroll_derive]]
1799 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1800 criteria = "safe-to-deploy"
1801 delta = "0.11.1 -> 0.12.0"
1802 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1804 [[audits.mozilla.audits.smawk]]
1805 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1806 criteria = "safe-to-deploy"
1808 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1810 [[audits.mozilla.audits.textwrap]]
1811 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1812 criteria = "safe-to-deploy"
1814 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"