diff --git a/.github/workflows/portfolio-check.yml b/.github/workflows/portfolio-check.yml new file mode 100644 index 0000000..46b9637 --- /dev/null +++ b/.github/workflows/portfolio-check.yml @@ -0,0 +1,28 @@ +# Portfolio check - calls the shared harness in Remade-With-Rust/.github. +# +# Managed by remade-updater. Edit the shared workflow, not this file: this exists +# only so the run attaches to the pull request, where a merge can wait on it. + +name: portfolio-check + +on: + pull_request: + # Also on the base branch, so a red pull request can be compared against a + # real run of THIS check on main. Without it the only baseline available is + # "are main's own checks green", which answers a different question: this + # harness is stricter than most repositories' own CI, so a pre-existing + # failure it alone catches looks exactly like a regression. + push: + branches: [main, master] + workflow_dispatch: + +permissions: + contents: read + +jobs: + check: + uses: Remade-With-Rust/.github/.github/workflows/portfolio-test.yml@main + with: + # FFAI's full test suite outruns the shared workflow's 60-minute limit; + # its own CI runs the tests. The portfolio gate is the cheap `check`. + command: check diff --git a/Cargo.lock b/Cargo.lock index 580e311..a710e1a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3974,9 +3974,9 @@ dependencies = [ [[package]] name = "rusty_alloc" -version = "2.2.0" +version = "2.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3689dec49611086f9a977596bbc1c8d7b2d1c21691438af506b793723ce16fa" +checksum = "c12ed1752127ac2fabc5bc5aed934055f4be5f093885d830a66686bff4cd7668" dependencies = [ "libc", "portable-atomic", @@ -3985,9 +3985,9 @@ dependencies = [ [[package]] name = "rusty_alloc-api" -version = "2.2.0" +version = "2.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6df579b05b731b70f98a73ec477aa889f7404be5f326da47691b32cdb94a8418" +checksum = "a68d299fc4818e1b26164556504f28240de294ea709c519ec465add9238f30f7" dependencies = [ "rusty_alloc", ] diff --git a/crates/ffai-argus-wasm/Cargo.toml b/crates/ffai-argus-wasm/Cargo.toml index ea5a521..77ceeff 100644 --- a/crates/ffai-argus-wasm/Cargo.toml +++ b/crates/ffai-argus-wasm/Cargo.toml @@ -36,7 +36,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # feeding an autoregressive decoder with a growing KV cache — so # `--no-default-features` keeps the dlmalloc arm buildable for whoever takes # that measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } # The gemm SIMD A/B, off by default. `gemm` is already in the tree beneath # candle; this makes its runtime switch reachable so a browser can measure diff --git a/crates/ffai-argus/Cargo.toml b/crates/ffai-argus/Cargo.toml index 59271f8..53b4ce5 100644 --- a/crates/ffai-argus/Cargo.toml +++ b/crates/ffai-argus/Cargo.toml @@ -63,7 +63,7 @@ getrandom = { version = "0.3", features = ["wasm_js"] } # places: a SigLIP/Llama forward allocates a 47 MB score tensor per layer, and # 47 MB is above the threshold where most allocators stop pooling and go # straight to the OS. See `examples/alloc_ab.rs`. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The step-3 oracle test reads the reference dump's summary.json. serde_json = { workspace = true } diff --git a/crates/ffai-carmenta-wasm/Cargo.toml b/crates/ffai-carmenta-wasm/Cargo.toml index 8181e11..397aed2 100644 --- a/crates/ffai-carmenta-wasm/Cargo.toml +++ b/crates/ffai-carmenta-wasm/Cargo.toml @@ -37,13 +37,13 @@ serde-wasm-bindgen = "0.6" # rusty_alloc at parity with dlmalloc on Diana's workload. Carmenta's # allocation pattern is different (many small line crops rather than one big # tensor chain), so the answer here is its own open measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } # The allocator CORE, for `arena::reserve_os_memory_ex`. `rusty_alloc-api` is # the mi_*-compatible surface and does not re-export the arena module, but on # wasm the arena is the ONLY layer that recycles a freed segment — `prim::free` # is a no-op there because linear memory cannot shrink. Same version as the # api crate, so this adds no second copy of the allocator. -rusty_alloc = { version = "=2.2.0", optional = true } +rusty_alloc = { version = "=2.2.5", optional = true } [features] # **`rusty_alloc`, and the "open measurement" this comment used to ask for has diff --git a/crates/ffai-carmenta/Cargo.toml b/crates/ffai-carmenta/Cargo.toml index 8922d68..bc059d7 100644 --- a/crates/ffai-carmenta/Cargo.toml +++ b/crates/ffai-carmenta/Cargo.toml @@ -84,7 +84,7 @@ tokenizers = { version = "0.23", default-features = false, features = ["unstable mimalloc = { version = "0.1", default-features = false } # Superseded as the default by the pure-Rust remake; see the allocator # doc comment in `ffai-cli/src/main.rs` for the measurement. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" ffai-media = { path = "../ffai-media" } ffai-bench = { path = "../ffai-bench" } diff --git a/crates/ffai-cli/Cargo.toml b/crates/ffai-cli/Cargo.toml index df74d0a..4d75ab3 100644 --- a/crates/ffai-cli/Cargo.toml +++ b/crates/ffai-cli/Cargo.toml @@ -64,10 +64,10 @@ mimalloc = { version = "0.1", default-features = false, optional = true } # It reproduced in the CLI (which declares this allocator) and never in an # example (which declared none and got the system one), and that difference is # what finally identified it. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — see `spawn_page_trimmer` in main.rs. # Without it rusty_alloc's RSS does not bound on a rayon pool. -rusty_alloc = "=2.2.0" +rusty_alloc = "=2.2.5" clap = { workspace = true } [features] diff --git a/crates/ffai-diana/Cargo.toml b/crates/ffai-diana/Cargo.toml index ccd4e14..f38a536 100644 --- a/crates/ffai-diana/Cargo.toml +++ b/crates/ffai-diana/Cargo.toml @@ -66,10 +66,10 @@ libmimalloc-sys = { version = "0.1", default-features = false } # margin the largest single effect in the Diana latency campaign (1.64x), so # it is simultaneously the dependency we most want to drop and the one that # costs the most to drop wrongly. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — the reclaim `examples/scaling.rs` drives. # `rusty_alloc-api` deliberately exposes collect only per-`Heap`. -rusty_alloc = "=2.2.0" +rusty_alloc = "=2.2.5" ffai-media = { path = "../ffai-media" } ffai-bench = { path = "../ffai-bench" } diff --git a/crates/ffai-mercury-wasm/Cargo.toml b/crates/ffai-mercury-wasm/Cargo.toml index 45dea00..dd9234d 100644 --- a/crates/ffai-mercury-wasm/Cargo.toml +++ b/crates/ffai-mercury-wasm/Cargo.toml @@ -38,7 +38,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # Mercury's allocation pattern is its own question — one long encoder/decoder # chain rather than many small crops — so `--no-default-features` keeps the # dlmalloc arm buildable for whoever takes that measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } [features] default = ["rusty-alloc"] diff --git a/crates/ffai-wasm/Cargo.toml b/crates/ffai-wasm/Cargo.toml index f153da6..cba4238 100644 --- a/crates/ffai-wasm/Cargo.toml +++ b/crates/ffai-wasm/Cargo.toml @@ -27,7 +27,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # pre-reservation is disabled there, because wasm `memory.grow` is never # returned to the host). Whether it beats dlmalloc on THIS workload is a # measurement we can now run, which is the point of having a cdylib at all. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } [features] # `rusty_alloc` is the default; `--no-default-features` leaves the target's own diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 99a2f00..6510f7e 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -555,6 +555,13 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2020-04-20" end = "2027-08-18" +[[trusted.portable-atomic]] +criteria = "safe-to-deploy" +trusted-publisher = "github:taiki-e/portable-atomic" +start = "2026-07-17" +end = "2027-10-08" +notes = "Owner decision 2026-10-08 (Tim Almond): trust portable-atomic's GitHub trusted-publishing workflow; target-gated dependency of rusty_alloc 2.x." + [[trusted.potential_utf]] criteria = "safe-to-deploy" user-id = 1139 # Manish Goregaokar (Manishearth) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 3b50ea6..784f06e 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -803,10 +803,6 @@ criteria = "safe-to-deploy" version = "0.3.33" criteria = "safe-to-deploy" -[[exemptions.portable-atomic]] -version = "1.14.0" -criteria = "safe-to-deploy" - [[exemptions.portable-atomic-util]] version = "0.2.7" criteria = "safe-to-deploy" @@ -984,11 +980,11 @@ version = "0.3.1" criteria = "safe-to-run" [[exemptions.rusty_alloc]] -version = "2.2.0" +version = "2.2.5" criteria = "safe-to-deploy" [[exemptions.rusty_alloc-api]] -version = "2.2.0" +version = "2.2.5" criteria = "safe-to-deploy" [[exemptions.rusty_expressions]] diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index c3a1b4b..5fbfb5a 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -510,6 +510,11 @@ user-id = 1139 user-login = "Manishearth" user-name = "Manish Goregaokar" +[[publisher.portable-atomic]] +version = "1.14.0" +when = "2026-07-17" +trusted-publisher = "github:taiki-e/portable-atomic" + [[publisher.potential_utf]] version = "0.1.5" when = "2026-04-01" @@ -2148,7 +2153,7 @@ start = "2019-03-29" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.core-graphics-types]] who = "Bobby Holley " @@ -2158,7 +2163,7 @@ start = "2020-07-20" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.encoding_rs]] who = "Henri Sivonen " @@ -2167,7 +2172,7 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2019-02-26" end = "2027-09-07" notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-normalization]] who = "Manish Goregaokar " @@ -2176,7 +2181,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-11-06" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-segmentation]] who = "Manish Goregaokar " @@ -2185,7 +2190,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-05-15" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.utf8_iter]] who = "Makoto Kato " @@ -2194,146 +2199,146 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2022-04-19" end = "2024-06-16" notes = "Maintained by Henri Sivonen who works at Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.adler2]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.0.0 -> 2.0.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.2.18" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.2.20 -> 0.2.21" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.1.2" notes = "I wrote this crate, reviewed by jimb. It is mostly a Rust port of some C++ code we already ship." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.2 -> 0.1.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.5" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.5.2" notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.5.2 -> 0.5.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.5.3 -> 0.6.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.6.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.6.3" notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.6.3 -> 0.7.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.7.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.block-buffer]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.block2]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.6.2" notes = "Contains unsafe code to interoperate with the ObjC runtime." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Alex Franchuk " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.1" notes = "Very minor changes." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.2.1 -> 0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-foundation]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.9.3 -> 0.9.4" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-graphics-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.1.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-graphics-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.2 -> 0.1.3" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.crunchy]] who = "Erich Gubler " criteria = "safe-to-deploy" version = "0.2.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.crypto-common]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.3 -> 0.1.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.deranged]] who = "Alex Franchuk " @@ -2344,7 +2349,7 @@ This crate contains a decent bit of `unsafe` code, however all internal unsafety is verified with copious assertions (many are compile-time), and otherwise the unsafety is documented and left to the caller to verify. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.deranged]] who = "Lars Eggert " @@ -2357,136 +2362,136 @@ who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.5.8" notes = "New unsafe code is properly guarded" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.errno]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.1 -> 0.3.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.fnv]] who = "Bobby Holley " criteria = "safe-to-deploy" version = "1.0.7" notes = "Simple hasher implementation with no unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foldhash]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.5 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foreign-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.3.2 -> 0.5.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foreign-types-shared]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" version = "1.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.2.0 -> 1.2.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "edgul " criteria = "safe-to-deploy" delta = "1.2.1 -> 1.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.futures-core]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.27 -> 0.3.28" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.futures-sink]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.27 -> 0.3.28" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.2 -> 0.15.5" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.5 -> 0.16.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.0 -> 0.16.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.1 -> 0.17.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.17.0 -> 0.17.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.5.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Henri Sivonen " criteria = "safe-to-deploy" delta = "0.5.0 -> 1.0.2" notes = "In the 0.5.0 to 1.0.2 delta, I, Henri Sivonen, rewrote the non-Punycode internals of the crate and made the changes to the Punycode code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.0.2 -> 1.0.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "edgul " criteria = "safe-to-deploy" delta = "1.0.3 -> 1.1.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.indexmap]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.8.0 -> 2.11.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.indexmap]] who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "2.11.4 -> 2.14.0" notes = "Mostly internal refactorings. No new unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.libloading]] who = "Jan-Erik Rediger " @@ -2499,13 +2504,13 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.macro_rules_attribute-proc_macro]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.malloc_buf]] who = "Bobby Holley " @@ -2517,52 +2522,52 @@ There is an edge-case condition that passes slice::from_raw_parts(0x1, 0) which not entirely certain is technically sound, but in either case I am reasonably confident it's not exploitable. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Jim Blandy " criteria = "safe-to-deploy" version = "0.23.1" notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.23.1 -> 0.24.0" notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.24.0 -> 0.25.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.25.0 -> 0.26.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Nicolas Silva , Jim Blandy " criteria = "safe-to-deploy" delta = "0.26.0 -> 0.27.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.27.0 -> 0.28.0" notes = "No significantly changed functionality. Some warnings resolved, bumped `core-graphics-types`, newer versions of Metal supported." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.28.0 -> 0.29.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.num-conv]] who = "Alex Franchuk " @@ -2572,14 +2577,14 @@ notes = """ Very straightforward, simple crate. No dependencies, unsafe, extern, side-effectful std functions, etc. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.num-conv]] who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.2.0" notes = "Revision only removes code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-core-foundation]] who = "Andy Leiserson " @@ -2595,14 +2600,14 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-encode]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "4.1.0" notes = "Support library for objc2 with no unsafe code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-foundation]] who = "Andy Leiserson " @@ -2618,7 +2623,7 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-metal]] who = "Andy Leiserson " @@ -2634,7 +2639,7 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.option-ext]] who = "Nika Layzell " @@ -2646,19 +2651,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supp who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.2.0 -> 2.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.3.0 -> 2.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "edgul " criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.powerfmt]] who = "Alex Franchuk " @@ -2668,56 +2673,56 @@ notes = """ A tiny bit of unsafe code to implement functionality that isn't in stable rust yet, but it's all valid. Otherwise it's a pretty simple crate. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" version = "0.5.4" notes = "This is a small crate, providing safe wrappers around various low-level networking specific operating system features. Given that the Rust standard library does not provide safe wrappers for these low-level features, safe wrappers need to be build in the crate itself, i.e. `quinn-udp`, thus requiring `unsafe` code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.4 -> 0.5.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.6 -> 0.5.8" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.8 -> 0.5.9" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.9 -> 0.5.10" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.10 -> 0.5.11" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.11 -> 0.5.12" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.12 -> 0.5.13" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quote]] who = "Jan-Erik Rediger " @@ -2739,7 +2744,7 @@ notes = """ Simple crate that extends `rand`. It has little unsafe code and uses Miri to test it. As far as I can tell, it does not have any file IO or network access. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.rustc_version]] who = "Nika Layzell " @@ -2756,19 +2761,19 @@ who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "1.0.16 -> 1.0.28" notes = "Very few changes, mostly removes support for older Rust versions. Some unsafe code refactored, but it seemed to be functionally equivalent to me." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.semver]] who = "Bobby Holley " criteria = "safe-to-deploy" delta = "1.0.17 -> 1.0.16" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sha2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sha2]] who = "Jeff Muizelaar " @@ -2779,19 +2784,19 @@ The bulk of this is https://github.com/RustCrypto/hashes/pull/490 which adds aar I didn't check the implementation thoroughly but there wasn't anything obviously nefarious. 0.10.8 has been out for more than a year which suggests no one else has found anything either. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sharded-slab]] who = "Mark Hammond " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.7" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Max Inden " criteria = "safe-to-deploy" delta = "1.1.0 -> 1.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Emilio Cobos Álvarez " @@ -2800,51 +2805,51 @@ delta = "1.3.0 -> 2.0.1" notes = """ Mostly removes some deprecated and unsound APIs. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.simdutf8]] who = "Henri Sivonen " criteria = "safe-to-deploy" version = "0.1.5" notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.smallvec]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "1.14.0 -> 1.15.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.smallvec]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "1.15.1 -> 1.15.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strsim]] who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "0.10.0 -> 0.11.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strum]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.25.0 -> 0.26.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strum_macros]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.25.3 -> 0.26.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.subtle]] who = "Simon Friedberger " criteria = "safe-to-deploy" version = "2.5.0" notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -2855,19 +2860,19 @@ I am the primary author of the `synstructure` crate, and its current maintainer. The one use of `unsafe` is unnecessary, but documented and harmless. It will be removed in the next version. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.12.6 -> 0.13.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.13.0 -> 0.13.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -2891,19 +2896,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Kershaw Chang " criteria = "safe-to-deploy" version = "0.1.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Kershaw Chang " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Alex Franchuk " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.1.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Lars Eggert " @@ -2916,13 +2921,13 @@ who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.8" notes = "No unsafe code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.tinyvec_macros]] who = "Drew Willcoxon " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.utf8parse]] who = "Nika Layzell " @@ -2941,13 +2946,13 @@ who = "Mark Hammond " criteria = "safe-to-deploy" version = "0.1.1" notes = "A microsoft crate allowing unsafe calls to windows apis." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.windows-link]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.zcash.audits.arrayref]] who = "Daira-Emma Hopwood "