From fe4b0fa4e234cf2bb89e9306ea7f84c525d013c6 Mon Sep 17 00:00:00 2001 From: Tim Date: Thu, 8 Oct 2026 12:06:32 -0700 Subject: [PATCH] chore(deps): rusty_alloc 2.2.0 -> 2.2.5; minor-bump the crates that pin it Every crate that installs or calls the allocator moves its exact pin to =2.2.5. The pin is exact, so a consumer that pins rusty_alloc itself must move too, and each crate takes a minor bump: argus 0.8.0, argus-wasm 0.2.0, carmenta 0.12.0, carmenta-wasm 0.3.0, cli 0.8.0, diana 0.8.0, mercury-wasm 0.2.0, wasm 0.2.0 2.2.5 is the first version since 2.2.0 that builds on MSVC with LTO and unwinding. That is our own release profile: a release build of ffai-cli on x86_64-pc-windows-msvc links and runs on it. 2.2.4 adds public fields to rusty_alloc::heap::Heap; FFai never builds one with a struct literal. cargo-vet exemptions move to 2.2.5, and the root CHANGELOG gives the 2026-09-28 release its own dated heading. Co-Authored-By: Claude Opus 5.5 (1M context) --- CHANGELOG.md | 36 +++ Cargo.lock | 26 +-- Cargo.toml | 8 +- crates/ffai-argus-wasm/CHANGELOG.md | 6 + crates/ffai-argus-wasm/Cargo.toml | 6 +- crates/ffai-argus/CHANGELOG.md | 6 + crates/ffai-argus/Cargo.toml | 2 +- crates/ffai-carmenta-wasm/CHANGELOG.md | 6 + crates/ffai-carmenta-wasm/Cargo.toml | 8 +- crates/ffai-carmenta/CHANGELOG.md | 6 + crates/ffai-carmenta/Cargo.toml | 4 +- crates/ffai-cli/CHANGELOG.md | 6 + crates/ffai-cli/Cargo.toml | 6 +- crates/ffai-diana/CHANGELOG.md | 6 + crates/ffai-diana/Cargo.toml | 6 +- crates/ffai-mercury-wasm/CHANGELOG.md | 6 + crates/ffai-mercury-wasm/Cargo.toml | 4 +- crates/ffai-wasm/CHANGELOG.md | 6 + crates/ffai-wasm/Cargo.toml | 4 +- supply-chain/config.toml | 12 +- supply-chain/imports.lock | 307 ++++++++++++++++--------- 21 files changed, 326 insertions(+), 151 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7df91e2..5f70d64 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,42 @@ mechanics are in `.github/workflows/release.yml`. ## [Unreleased] +### rusty_alloc 2.2.0 → 2.2.5 + +Every crate that installs or calls the allocator moves to the exact pin +`=2.2.5`. Because the pin is exact, a consumer that pins rusty_alloc itself +has to move with it, so each crate takes a minor bump: + +| crate | from | to | +|---|---|---| +| `ffai-argus` (workspace version) | 0.7.5 | **0.8.0** | +| `ffai-argus-wasm` | 0.1.3 | **0.2.0** | +| `ffai-carmenta` | 0.11.0 | **0.12.0** | +| `ffai-carmenta-wasm` | 0.2.3 | **0.3.0** | +| `ffai-cli` | 0.7.0 | **0.8.0** | +| `ffai-diana` | 0.7.8 | **0.8.0** | +| `ffai-mercury-wasm` | 0.1.3 | **0.2.0** | +| `ffai-wasm` | 0.1.5 | **0.2.0** | + +What the allocator fixes, as it affects FFai: + +- **2.2.5:** builds on MSVC with LTO and `panic = "unwind"`. That is our own + release profile (`lto = "thin"`, default panic), so 2.2.1 to 2.2.4 were + never an option on Windows. +- **2.2.4:** freed model memory is no longer stranded after a loader thread + exits, and a freed huge block (over 32 MiB; Whisper-small's embedding is + 152 MiB) is purged when purging is on. +- **2.2.3:** on Windows with purging on, a failed re-commit is now an + allocation failure rather than an access violation. +- **2.2.1:** `realloc` of a huge block copies the request, not the whole + reservation; process start-up makes 12 allocations instead of 263; a + cross-thread double free aborts instead of hanging. + +2.2.4 added public fields to `rusty_alloc::heap::Heap`. FFai never builds one +with a struct literal, so nothing here changes. + +## [2026-09-28] — commercial gaps: core 0.8, carmenta 0.11, cli 0.7 + ### Versions | crate | from | to | why | diff --git a/Cargo.lock b/Cargo.lock index 580e311..0bdc333 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1226,7 +1226,7 @@ dependencies = [ [[package]] name = "ffai-argus" -version = "0.7.5" +version = "0.8.0" dependencies = [ "candle-core", "candle-nn", @@ -1244,7 +1244,7 @@ dependencies = [ [[package]] name = "ffai-argus-wasm" -version = "0.1.3" +version = "0.2.0" dependencies = [ "ffai-argus", "ffai-core", @@ -1274,7 +1274,7 @@ dependencies = [ [[package]] name = "ffai-carmenta" -version = "0.11.0" +version = "0.12.0" dependencies = [ "candle-core", "candle-nn", @@ -1295,7 +1295,7 @@ dependencies = [ [[package]] name = "ffai-carmenta-wasm" -version = "0.2.3" +version = "0.3.0" dependencies = [ "ffai-carmenta", "ffai-core", @@ -1310,7 +1310,7 @@ dependencies = [ [[package]] name = "ffai-cli" -version = "0.7.0" +version = "0.8.0" dependencies = [ "anyhow", "clap", @@ -1338,7 +1338,7 @@ dependencies = [ [[package]] name = "ffai-demo" -version = "0.7.5" +version = "0.8.0" dependencies = [ "ffai-argus", "ffai-bench", @@ -1351,7 +1351,7 @@ dependencies = [ [[package]] name = "ffai-diana" -version = "0.7.8" +version = "0.8.0" dependencies = [ "candle-core", "candle-nn", @@ -1412,7 +1412,7 @@ dependencies = [ [[package]] name = "ffai-mercury-wasm" -version = "0.1.3" +version = "0.2.0" dependencies = [ "ffai-core", "ffai-mercury", @@ -1446,7 +1446,7 @@ dependencies = [ [[package]] name = "ffai-wasm" -version = "0.1.5" +version = "0.2.0" dependencies = [ "ffai-core", "ffai-diana", @@ -3974,9 +3974,9 @@ dependencies = [ [[package]] name = "rusty_alloc" -version = "2.2.0" +version = "2.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3689dec49611086f9a977596bbc1c8d7b2d1c21691438af506b793723ce16fa" +checksum = "c12ed1752127ac2fabc5bc5aed934055f4be5f093885d830a66686bff4cd7668" dependencies = [ "libc", "portable-atomic", @@ -3985,9 +3985,9 @@ dependencies = [ [[package]] name = "rusty_alloc-api" -version = "2.2.0" +version = "2.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6df579b05b731b70f98a73ec477aa889f7404be5f326da47691b32cdb94a8418" +checksum = "a68d299fc4818e1b26164556504f28240de294ea709c519ec465add9238f30f7" dependencies = [ "rusty_alloc", ] diff --git a/Cargo.toml b/Cargo.toml index beddd69..d63caa2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -7,7 +7,7 @@ members = ["crates/*"] exclude = ["demo-ui"] [workspace.package] -version = "0.7.5" +version = "0.8.0" edition = "2024" rust-version = "1.95" license = "MIT OR Apache-2.0" @@ -20,9 +20,9 @@ ffai-core = { path = "crates/ffai-core", version = "0.8.0" } ffai-media = { path = "crates/ffai-media", version = "0.6.8" } ffai-models = { path = "crates/ffai-models", version = "0.6.6" } ffai-mercury = { path = "crates/ffai-mercury", version = "1.0.5" } -ffai-carmenta = { path = "crates/ffai-carmenta", version = "0.11.0" } -ffai-diana = { path = "crates/ffai-diana", version = "0.7.8" } -ffai-argus = { path = "crates/ffai-argus", version = "0.7.5" } +ffai-carmenta = { path = "crates/ffai-carmenta", version = "0.12.0" } +ffai-diana = { path = "crates/ffai-diana", version = "0.8.0" } +ffai-argus = { path = "crates/ffai-argus", version = "0.8.0" } ffai-bench = { path = "crates/ffai-bench", version = "0.7.7" } # ---- tensor spine ---- diff --git a/crates/ffai-argus-wasm/CHANGELOG.md b/crates/ffai-argus-wasm/CHANGELOG.md index 1d0bdd8..3dcc3ec 100644 --- a/crates/ffai-argus-wasm/CHANGELOG.md +++ b/crates/ffai-argus-wasm/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.2.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-wasm-v0.1.3...ffai-argus-wasm-v0.2.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.1.3](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-wasm-v0.1.2...ffai-argus-wasm-v0.1.3) - 2026-09-25 ### Other diff --git a/crates/ffai-argus-wasm/Cargo.toml b/crates/ffai-argus-wasm/Cargo.toml index ea5a521..eb94129 100644 --- a/crates/ffai-argus-wasm/Cargo.toml +++ b/crates/ffai-argus-wasm/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "ffai-argus-wasm" description = "Argus in the browser — pure-Rust SmolVLM image captioning compiled to WebAssembly, no ONNX runtime, no Python" -version = "0.1.3" +version = "0.2.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -25,7 +25,7 @@ ffai-core = { workspace = true } # **0.7.2, not 0.7.1** — see the note in `ffai-mercury-wasm`. `SmolVlm::from_bytes` # and `ArgusBytes` first exist in 0.7.2, and a tarball verification resolves # this from crates.io rather than from the path. -ffai-argus = { path = "../ffai-argus", version = "0.7.5", default-features = false } +ffai-argus = { path = "../ffai-argus", version = "0.8.0", default-features = false } wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two must match exactly # The binary is the only thing entitled to choose an allocator, and a cdylib IS @@ -36,7 +36,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # feeding an autoregressive decoder with a growing KV cache — so # `--no-default-features` keeps the dlmalloc arm buildable for whoever takes # that measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } # The gemm SIMD A/B, off by default. `gemm` is already in the tree beneath # candle; this makes its runtime switch reachable so a browser can measure diff --git a/crates/ffai-argus/CHANGELOG.md b/crates/ffai-argus/CHANGELOG.md index 2966e8f..b7d1e9a 100644 --- a/crates/ffai-argus/CHANGELOG.md +++ b/crates/ffai-argus/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.8.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-v0.7.5...ffai-argus-v0.8.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.7.5](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-v0.7.4...ffai-argus-v0.7.5) - 2026-09-25 ### Other diff --git a/crates/ffai-argus/Cargo.toml b/crates/ffai-argus/Cargo.toml index 59271f8..53b4ce5 100644 --- a/crates/ffai-argus/Cargo.toml +++ b/crates/ffai-argus/Cargo.toml @@ -63,7 +63,7 @@ getrandom = { version = "0.3", features = ["wasm_js"] } # places: a SigLIP/Llama forward allocates a 47 MB score tensor per layer, and # 47 MB is above the threshold where most allocators stop pooling and go # straight to the OS. See `examples/alloc_ab.rs`. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The step-3 oracle test reads the reference dump's summary.json. serde_json = { workspace = true } diff --git a/crates/ffai-carmenta-wasm/CHANGELOG.md b/crates/ffai-carmenta-wasm/CHANGELOG.md index d3630e0..0b3ce2f 100644 --- a/crates/ffai-carmenta-wasm/CHANGELOG.md +++ b/crates/ffai-carmenta-wasm/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.3.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-wasm-v0.2.3...ffai-carmenta-wasm-v0.3.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.2.3](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-wasm-v0.2.2...ffai-carmenta-wasm-v0.2.3) - 2026-09-25 ### Other diff --git a/crates/ffai-carmenta-wasm/Cargo.toml b/crates/ffai-carmenta-wasm/Cargo.toml index 8181e11..7d49ea1 100644 --- a/crates/ffai-carmenta-wasm/Cargo.toml +++ b/crates/ffai-carmenta-wasm/Cargo.toml @@ -5,7 +5,7 @@ description = "Carmenta in the browser — pure-Rust OCR compiled to WebAssembly # slice. The JS signature is unchanged — it is still a `Uint8Array` — but the # Rust signature is, so this is a breaking change for a Rust consumer even # though a browser sees nothing. Adds `setDetMaxShort` and `linearMemoryBytes`. -version = "0.2.3" +version = "0.3.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -26,7 +26,7 @@ ffai-core = { workspace = true } # release calls `reqwest::blocking` — a module that does not exist on wasm32. # Nothing in a browser can fetch weights through the model cache anyway: the # caller supplies bytes. -ffai-carmenta = { path = "../ffai-carmenta", version = "0.11.0", default-features = false } +ffai-carmenta = { path = "../ffai-carmenta", version = "0.12.0", default-features = false } wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two must match exactly serde = { workspace = true } serde_json = { workspace = true } @@ -37,13 +37,13 @@ serde-wasm-bindgen = "0.6" # rusty_alloc at parity with dlmalloc on Diana's workload. Carmenta's # allocation pattern is different (many small line crops rather than one big # tensor chain), so the answer here is its own open measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } # The allocator CORE, for `arena::reserve_os_memory_ex`. `rusty_alloc-api` is # the mi_*-compatible surface and does not re-export the arena module, but on # wasm the arena is the ONLY layer that recycles a freed segment — `prim::free` # is a no-op there because linear memory cannot shrink. Same version as the # api crate, so this adds no second copy of the allocator. -rusty_alloc = { version = "=2.2.0", optional = true } +rusty_alloc = { version = "=2.2.5", optional = true } [features] # **`rusty_alloc`, and the "open measurement" this comment used to ask for has diff --git a/crates/ffai-carmenta/CHANGELOG.md b/crates/ffai-carmenta/CHANGELOG.md index 8d133a0..7cafa96 100644 --- a/crates/ffai-carmenta/CHANGELOG.md +++ b/crates/ffai-carmenta/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.12.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-v0.11.0...ffai-carmenta-v0.12.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.11.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-v0.10.2...ffai-carmenta-v0.11.0) - 2026-09-25 ### Added diff --git a/crates/ffai-carmenta/Cargo.toml b/crates/ffai-carmenta/Cargo.toml index 8922d68..f7aad95 100644 --- a/crates/ffai-carmenta/Cargo.toml +++ b/crates/ffai-carmenta/Cargo.toml @@ -38,7 +38,7 @@ description = "Carmenta — pure-Rust OCR: documents, screens, and a change-gate # (cord +0.0033 with a +0.1928 clip, doc +0.0395 with a +0.2920 clip) — the same # failure the 544x960 arm produced, smaller. 1280 is the only arm that improves # both with no badly-regressing clip. The table lives on `DET_MAX_SHORT_DEFAULT`. -version = "0.11.0" +version = "0.12.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -84,7 +84,7 @@ tokenizers = { version = "0.23", default-features = false, features = ["unstable mimalloc = { version = "0.1", default-features = false } # Superseded as the default by the pure-Rust remake; see the allocator # doc comment in `ffai-cli/src/main.rs` for the measurement. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" ffai-media = { path = "../ffai-media" } ffai-bench = { path = "../ffai-bench" } diff --git a/crates/ffai-cli/CHANGELOG.md b/crates/ffai-cli/CHANGELOG.md index aa4ba69..ad523af 100644 --- a/crates/ffai-cli/CHANGELOG.md +++ b/crates/ffai-cli/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.8.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-cli-v0.7.0...ffai-cli-v0.8.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.7.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-cli-v0.6.9...ffai-cli-v0.7.0) - 2026-09-25 ### Added diff --git a/crates/ffai-cli/Cargo.toml b/crates/ffai-cli/Cargo.toml index df74d0a..f0ae1f6 100644 --- a/crates/ffai-cli/Cargo.toml +++ b/crates/ffai-cli/Cargo.toml @@ -2,7 +2,7 @@ name = "ffai-cli" description = "The ffai binary — a thin shell over the FFai library crates" # follows its dependencies. -version = "0.7.0" +version = "0.8.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -64,10 +64,10 @@ mimalloc = { version = "0.1", default-features = false, optional = true } # It reproduced in the CLI (which declares this allocator) and never in an # example (which declared none and got the system one), and that difference is # what finally identified it. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — see `spawn_page_trimmer` in main.rs. # Without it rusty_alloc's RSS does not bound on a rayon pool. -rusty_alloc = "=2.2.0" +rusty_alloc = "=2.2.5" clap = { workspace = true } [features] diff --git a/crates/ffai-diana/CHANGELOG.md b/crates/ffai-diana/CHANGELOG.md index 683ad8b..fbbb74d 100644 --- a/crates/ffai-diana/CHANGELOG.md +++ b/crates/ffai-diana/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.8.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-diana-v0.7.8...ffai-diana-v0.8.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.7.8](https://github.com/Remade-With-Rust/FFAI/compare/ffai-diana-v0.7.7...ffai-diana-v0.7.8) - 2026-09-25 ### Other diff --git a/crates/ffai-diana/Cargo.toml b/crates/ffai-diana/Cargo.toml index ccd4e14..3eb26d2 100644 --- a/crates/ffai-diana/Cargo.toml +++ b/crates/ffai-diana/Cargo.toml @@ -3,7 +3,7 @@ name = "ffai-diana" description = "Diana — FFai's detection component (YOLO26 on candle, pure Rust)" # 0.7.3 is a documentation-only republish: README restructured to the shared # Remade With Rust page layout. No code, API or output change. -version = "0.7.8" +version = "0.8.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -66,10 +66,10 @@ libmimalloc-sys = { version = "0.1", default-features = false } # margin the largest single effect in the Diana latency campaign (1.64x), so # it is simultaneously the dependency we most want to drop and the one that # costs the most to drop wrongly. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — the reclaim `examples/scaling.rs` drives. # `rusty_alloc-api` deliberately exposes collect only per-`Heap`. -rusty_alloc = "=2.2.0" +rusty_alloc = "=2.2.5" ffai-media = { path = "../ffai-media" } ffai-bench = { path = "../ffai-bench" } diff --git a/crates/ffai-mercury-wasm/CHANGELOG.md b/crates/ffai-mercury-wasm/CHANGELOG.md index ce40c41..e683ecc 100644 --- a/crates/ffai-mercury-wasm/CHANGELOG.md +++ b/crates/ffai-mercury-wasm/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.2.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-mercury-wasm-v0.1.3...ffai-mercury-wasm-v0.2.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.1.3](https://github.com/Remade-With-Rust/FFAI/compare/ffai-mercury-wasm-v0.1.2...ffai-mercury-wasm-v0.1.3) - 2026-09-25 ### Other diff --git a/crates/ffai-mercury-wasm/Cargo.toml b/crates/ffai-mercury-wasm/Cargo.toml index 45dea00..ef334ce 100644 --- a/crates/ffai-mercury-wasm/Cargo.toml +++ b/crates/ffai-mercury-wasm/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "ffai-mercury-wasm" description = "Mercury in the browser — pure-Rust Whisper speech recognition compiled to WebAssembly, no whisper.cpp, no ONNX runtime" -version = "0.1.3" +version = "0.2.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -38,7 +38,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # Mercury's allocation pattern is its own question — one long encoder/decoder # chain rather than many small crops — so `--no-default-features` keeps the # dlmalloc arm buildable for whoever takes that measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } [features] default = ["rusty-alloc"] diff --git a/crates/ffai-wasm/CHANGELOG.md b/crates/ffai-wasm/CHANGELOG.md index d77ca48..ae702cd 100644 --- a/crates/ffai-wasm/CHANGELOG.md +++ b/crates/ffai-wasm/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.2.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-wasm-v0.1.5...ffai-wasm-v0.2.0) - 2026-10-08 + +### Changed + +- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too + ## [0.1.5](https://github.com/Remade-With-Rust/FFAI/compare/ffai-wasm-v0.1.4...ffai-wasm-v0.1.5) - 2026-09-25 ### Other diff --git a/crates/ffai-wasm/Cargo.toml b/crates/ffai-wasm/Cargo.toml index f153da6..4124f6a 100644 --- a/crates/ffai-wasm/Cargo.toml +++ b/crates/ffai-wasm/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "ffai-wasm" description = "Diana in the browser — YOLO26 object detection compiled to WebAssembly, pure Rust, no ONNX runtime" -version = "0.1.5" +version = "0.2.0" edition.workspace = true rust-version.workspace = true license.workspace = true @@ -27,7 +27,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # pre-reservation is disabled there, because wasm `memory.grow` is never # returned to the host). Whether it beats dlmalloc on THIS workload is a # measurement we can now run, which is the point of having a cdylib at all. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } [features] # `rusty_alloc` is the default; `--no-default-features` leaves the target's own diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 3b50ea6..65b3650 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -687,10 +687,6 @@ criteria = "safe-to-deploy" version = "0.2.0" criteria = "safe-to-deploy" -[[exemptions.log]] -version = "0.4.33" -criteria = "safe-to-deploy" - [[exemptions.lopdf]] version = "0.44.0" criteria = "safe-to-deploy" @@ -984,11 +980,11 @@ version = "0.3.1" criteria = "safe-to-run" [[exemptions.rusty_alloc]] -version = "2.2.0" +version = "2.2.5" criteria = "safe-to-deploy" [[exemptions.rusty_alloc-api]] -version = "2.2.0" +version = "2.2.5" criteria = "safe-to-deploy" [[exemptions.rusty_expressions]] @@ -1191,10 +1187,6 @@ criteria = "safe-to-deploy" version = "0.1.31" criteria = "safe-to-deploy" -[[exemptions.tracing-core]] -version = "0.1.36" -criteria = "safe-to-deploy" - [[exemptions.tracing-serde]] version = "0.2.0" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index c3a1b4b..20231e9 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -5,10 +5,18 @@ version = "0.7.5" audited_as = "0.7.4" +[[unpublished.ffai-argus]] +version = "0.8.0" +audited_as = "0.7.5" + [[unpublished.ffai-argus-wasm]] version = "0.1.3" audited_as = "0.1.2" +[[unpublished.ffai-argus-wasm]] +version = "0.2.0" +audited_as = "0.1.3" + [[unpublished.ffai-bench]] version = "0.7.7" audited_as = "0.7.6" @@ -17,14 +25,26 @@ audited_as = "0.7.6" version = "0.11.0" audited_as = "0.10.2" +[[unpublished.ffai-carmenta]] +version = "0.12.0" +audited_as = "0.11.0" + [[unpublished.ffai-carmenta-wasm]] version = "0.2.3" audited_as = "0.2.2" +[[unpublished.ffai-carmenta-wasm]] +version = "0.3.0" +audited_as = "0.2.3" + [[unpublished.ffai-cli]] version = "0.7.0" audited_as = "0.6.9" +[[unpublished.ffai-cli]] +version = "0.8.0" +audited_as = "0.7.0" + [[unpublished.ffai-core]] version = "0.8.0" audited_as = "0.7.2" @@ -33,6 +53,10 @@ audited_as = "0.7.2" version = "0.7.8" audited_as = "0.7.7" +[[unpublished.ffai-diana]] +version = "0.8.0" +audited_as = "0.7.8" + [[unpublished.ffai-media]] version = "0.6.8" audited_as = "0.6.7" @@ -45,6 +69,10 @@ audited_as = "1.0.4" version = "0.1.3" audited_as = "0.1.2" +[[unpublished.ffai-mercury-wasm]] +version = "0.2.0" +audited_as = "0.1.3" + [[unpublished.ffai-models]] version = "0.6.6" audited_as = "0.6.5" @@ -53,6 +81,10 @@ audited_as = "0.6.5" version = "0.1.5" audited_as = "0.1.4" +[[unpublished.ffai-wasm]] +version = "0.2.0" +audited_as = "0.1.5" + [[publisher.aho-corasick]] version = "1.1.4" when = "2025-10-28" @@ -1239,6 +1271,12 @@ who = "Nils Ponsard " criteria = "safe-to-deploy" delta = "0.3.31 -> 0.3.32" +[[audits.ariel-os.audits.log]] +who = "Koen Zandberg " +criteria = "safe-to-deploy" +delta = "0.4.29 -> 0.4.33" +notes = "No changes to unsafe code. Newly added code looks reasonable." + [[audits.bytecode-alliance.wildcard-audits.bumpalo]] who = "Nick Fitzgerald " criteria = "safe-to-deploy" @@ -1512,6 +1550,12 @@ criteria = "safe-to-deploy" delta = "0.4.45 -> 0.4.46" notes = "Nothing awry, no changes to unsafe or such." +[[audits.bytecode-alliance.audits.tracing-core]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.1.33 -> 0.1.34" +notes = "Mostly just an update with Rust stylistic conventions changing. Nothing awry." + [[audits.bytecode-alliance.audits.tracing-log]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -1798,6 +1842,32 @@ delta = "1.4.0 -> 1.5.0" notes = "Unsafe review notes: https://crrev.com/c/5650836" aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" +[[audits.google.audits.log]] +who = "danakj " +criteria = "safe-to-deploy" +version = "0.4.22" +notes = """ +Unsafe review in https://docs.google.com/document/d/1IXQbD1GhTRqNHIGxq6yy7qHqxeO4CwN5noMFXnqyDIM/edit?usp=sharing + +Unsafety is generally very well-documented, with one exception, which we +describe in the review doc. +""" +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.log]] +who = "Lukasz Anforowicz " +criteria = "safe-to-deploy" +delta = "0.4.22 -> 0.4.25" +notes = "No impact on `unsafe` usage in `lib.rs`." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + +[[audits.google.audits.log]] +who = "Daniel Cheng " +criteria = "safe-to-deploy" +delta = "0.4.25 -> 0.4.26" +notes = "Only trivial code and documentation changes." +aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" + [[audits.google.audits.nom]] who = "danakj@chromium.org" criteria = "safe-to-deploy" @@ -2148,7 +2218,7 @@ start = "2019-03-29" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.core-graphics-types]] who = "Bobby Holley " @@ -2158,7 +2228,7 @@ start = "2020-07-20" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.encoding_rs]] who = "Henri Sivonen " @@ -2167,7 +2237,7 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2019-02-26" end = "2027-09-07" notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-normalization]] who = "Manish Goregaokar " @@ -2176,7 +2246,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-11-06" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-segmentation]] who = "Manish Goregaokar " @@ -2185,7 +2255,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-05-15" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.utf8_iter]] who = "Makoto Kato " @@ -2194,146 +2264,146 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2022-04-19" end = "2024-06-16" notes = "Maintained by Henri Sivonen who works at Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.adler2]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.0.0 -> 2.0.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.2.18" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.2.20 -> 0.2.21" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.1.2" notes = "I wrote this crate, reviewed by jimb. It is mostly a Rust port of some C++ code we already ship." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.2 -> 0.1.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.5" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.5.2" notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.5.2 -> 0.5.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.5.3 -> 0.6.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.6.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.6.3" notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.6.3 -> 0.7.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.7.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.block-buffer]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.block2]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.6.2" notes = "Contains unsafe code to interoperate with the ObjC runtime." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Alex Franchuk " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.1" notes = "Very minor changes." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.2.1 -> 0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-foundation]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.9.3 -> 0.9.4" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-graphics-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.1.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-graphics-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.2 -> 0.1.3" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.crunchy]] who = "Erich Gubler " criteria = "safe-to-deploy" version = "0.2.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.crypto-common]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.3 -> 0.1.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.deranged]] who = "Alex Franchuk " @@ -2344,7 +2414,7 @@ This crate contains a decent bit of `unsafe` code, however all internal unsafety is verified with copious assertions (many are compile-time), and otherwise the unsafety is documented and left to the caller to verify. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.deranged]] who = "Lars Eggert " @@ -2357,136 +2427,136 @@ who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.5.8" notes = "New unsafe code is properly guarded" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.errno]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.1 -> 0.3.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.fnv]] who = "Bobby Holley " criteria = "safe-to-deploy" version = "1.0.7" notes = "Simple hasher implementation with no unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foldhash]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.5 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foreign-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.3.2 -> 0.5.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foreign-types-shared]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" version = "1.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.2.0 -> 1.2.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "edgul " criteria = "safe-to-deploy" delta = "1.2.1 -> 1.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.futures-core]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.27 -> 0.3.28" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.futures-sink]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.27 -> 0.3.28" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.2 -> 0.15.5" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.5 -> 0.16.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.0 -> 0.16.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.1 -> 0.17.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.17.0 -> 0.17.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.5.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Henri Sivonen " criteria = "safe-to-deploy" delta = "0.5.0 -> 1.0.2" notes = "In the 0.5.0 to 1.0.2 delta, I, Henri Sivonen, rewrote the non-Punycode internals of the crate and made the changes to the Punycode code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.0.2 -> 1.0.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "edgul " criteria = "safe-to-deploy" delta = "1.0.3 -> 1.1.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.indexmap]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.8.0 -> 2.11.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.indexmap]] who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "2.11.4 -> 2.14.0" notes = "Mostly internal refactorings. No new unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.libloading]] who = "Jan-Erik Rediger " @@ -2495,17 +2565,23 @@ version = "0.9.0" notes = "The exposed functionality is inherently unsafe, but all such functions are correctly tagged as `unsafe` and requirements documented. It also includes extensive documentation about the choices made about differing platform APIs" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" +[[audits.mozilla.audits.log]] +who = "Erich Gubler " +criteria = "safe-to-deploy" +delta = "0.4.26 -> 0.4.29" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.macro_rules_attribute]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.macro_rules_attribute-proc_macro]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.malloc_buf]] who = "Bobby Holley " @@ -2517,52 +2593,52 @@ There is an edge-case condition that passes slice::from_raw_parts(0x1, 0) which not entirely certain is technically sound, but in either case I am reasonably confident it's not exploitable. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Jim Blandy " criteria = "safe-to-deploy" version = "0.23.1" notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.23.1 -> 0.24.0" notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.24.0 -> 0.25.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.25.0 -> 0.26.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Nicolas Silva , Jim Blandy " criteria = "safe-to-deploy" delta = "0.26.0 -> 0.27.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.27.0 -> 0.28.0" notes = "No significantly changed functionality. Some warnings resolved, bumped `core-graphics-types`, newer versions of Metal supported." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.28.0 -> 0.29.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.num-conv]] who = "Alex Franchuk " @@ -2572,14 +2648,14 @@ notes = """ Very straightforward, simple crate. No dependencies, unsafe, extern, side-effectful std functions, etc. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.num-conv]] who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.2.0" notes = "Revision only removes code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-core-foundation]] who = "Andy Leiserson " @@ -2595,14 +2671,14 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-encode]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "4.1.0" notes = "Support library for objc2 with no unsafe code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-foundation]] who = "Andy Leiserson " @@ -2618,7 +2694,7 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-metal]] who = "Andy Leiserson " @@ -2634,7 +2710,7 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.option-ext]] who = "Nika Layzell " @@ -2646,19 +2722,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supp who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.2.0 -> 2.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.3.0 -> 2.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "edgul " criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.powerfmt]] who = "Alex Franchuk " @@ -2668,56 +2744,56 @@ notes = """ A tiny bit of unsafe code to implement functionality that isn't in stable rust yet, but it's all valid. Otherwise it's a pretty simple crate. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" version = "0.5.4" notes = "This is a small crate, providing safe wrappers around various low-level networking specific operating system features. Given that the Rust standard library does not provide safe wrappers for these low-level features, safe wrappers need to be build in the crate itself, i.e. `quinn-udp`, thus requiring `unsafe` code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.4 -> 0.5.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.6 -> 0.5.8" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.8 -> 0.5.9" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.9 -> 0.5.10" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.10 -> 0.5.11" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.11 -> 0.5.12" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.12 -> 0.5.13" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quote]] who = "Jan-Erik Rediger " @@ -2739,7 +2815,7 @@ notes = """ Simple crate that extends `rand`. It has little unsafe code and uses Miri to test it. As far as I can tell, it does not have any file IO or network access. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.rustc_version]] who = "Nika Layzell " @@ -2756,19 +2832,19 @@ who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "1.0.16 -> 1.0.28" notes = "Very few changes, mostly removes support for older Rust versions. Some unsafe code refactored, but it seemed to be functionally equivalent to me." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.semver]] who = "Bobby Holley " criteria = "safe-to-deploy" delta = "1.0.17 -> 1.0.16" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sha2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sha2]] who = "Jeff Muizelaar " @@ -2779,19 +2855,19 @@ The bulk of this is https://github.com/RustCrypto/hashes/pull/490 which adds aar I didn't check the implementation thoroughly but there wasn't anything obviously nefarious. 0.10.8 has been out for more than a year which suggests no one else has found anything either. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sharded-slab]] who = "Mark Hammond " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.7" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Max Inden " criteria = "safe-to-deploy" delta = "1.1.0 -> 1.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Emilio Cobos Álvarez " @@ -2800,51 +2876,51 @@ delta = "1.3.0 -> 2.0.1" notes = """ Mostly removes some deprecated and unsound APIs. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.simdutf8]] who = "Henri Sivonen " criteria = "safe-to-deploy" version = "0.1.5" notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.smallvec]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "1.14.0 -> 1.15.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.smallvec]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "1.15.1 -> 1.15.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strsim]] who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "0.10.0 -> 0.11.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strum]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.25.0 -> 0.26.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strum_macros]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.25.3 -> 0.26.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.subtle]] who = "Simon Friedberger " criteria = "safe-to-deploy" version = "2.5.0" notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -2855,19 +2931,19 @@ I am the primary author of the `synstructure` crate, and its current maintainer. The one use of `unsafe` is unnecessary, but documented and harmless. It will be removed in the next version. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.12.6 -> 0.13.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.13.0 -> 0.13.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -2891,19 +2967,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Kershaw Chang " criteria = "safe-to-deploy" version = "0.1.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Kershaw Chang " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Alex Franchuk " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.1.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Lars Eggert " @@ -2916,13 +2992,36 @@ who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.8" notes = "No unsafe code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.tinyvec_macros]] who = "Drew Willcoxon " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.1.30" +notes = """ +Most unsafe code is in implementing non-std sync primitives. Unsafe impls are +logically correct and justified in comments, and unsafe code is sound and +justified in comments. +""" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Mark Hammond " +criteria = "safe-to-deploy" +delta = "0.1.30 -> 0.1.33" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.1.34 -> 0.1.36" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" [[audits.mozilla.audits.utf8parse]] who = "Nika Layzell " @@ -2941,13 +3040,13 @@ who = "Mark Hammond " criteria = "safe-to-deploy" version = "0.1.1" notes = "A microsoft crate allowing unsafe calls to windows apis." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.windows-link]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.zcash.audits.arrayref]] who = "Daira-Emma Hopwood "