From 9d4a8fe614a20fe66562b4aa8f003d59b15e90bb Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:22:50 -0700 Subject: [PATCH 01/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-argus-wasm/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-argus-wasm/Cargo.toml b/crates/ffai-argus-wasm/Cargo.toml index ea5a521..77ceeff 100644 --- a/crates/ffai-argus-wasm/Cargo.toml +++ b/crates/ffai-argus-wasm/Cargo.toml @@ -36,7 +36,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # feeding an autoregressive decoder with a growing KV cache — so # `--no-default-features` keeps the dlmalloc arm buildable for whoever takes # that measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } # The gemm SIMD A/B, off by default. `gemm` is already in the tree beneath # candle; this makes its runtime switch reachable so a browser can measure From c2588814d2ebf2ba2b18acb18ea588cab25464da Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:22:53 -0700 Subject: [PATCH 02/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-argus/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-argus/Cargo.toml b/crates/ffai-argus/Cargo.toml index 59271f8..53b4ce5 100644 --- a/crates/ffai-argus/Cargo.toml +++ b/crates/ffai-argus/Cargo.toml @@ -63,7 +63,7 @@ getrandom = { version = "0.3", features = ["wasm_js"] } # places: a SigLIP/Llama forward allocates a 47 MB score tensor per layer, and # 47 MB is above the threshold where most allocators stop pooling and go # straight to the OS. See `examples/alloc_ab.rs`. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The step-3 oracle test reads the reference dump's summary.json. serde_json = { workspace = true } From 83f8d4e9389f74faf58c12942e517b9ec5e71c85 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:22:54 -0700 Subject: [PATCH 03/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-carmenta-wasm/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-carmenta-wasm/Cargo.toml b/crates/ffai-carmenta-wasm/Cargo.toml index 8181e11..9d95e9b 100644 --- a/crates/ffai-carmenta-wasm/Cargo.toml +++ b/crates/ffai-carmenta-wasm/Cargo.toml @@ -37,7 +37,7 @@ serde-wasm-bindgen = "0.6" # rusty_alloc at parity with dlmalloc on Diana's workload. Carmenta's # allocation pattern is different (many small line crops rather than one big # tensor chain), so the answer here is its own open measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } # The allocator CORE, for `arena::reserve_os_memory_ex`. `rusty_alloc-api` is # the mi_*-compatible surface and does not re-export the arena module, but on # wasm the arena is the ONLY layer that recycles a freed segment — `prim::free` From 753b1c587a51f27bfd43096d7a50f89f1a9666c2 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:22:56 -0700 Subject: [PATCH 04/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-carmenta/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-carmenta/Cargo.toml b/crates/ffai-carmenta/Cargo.toml index 8922d68..bc059d7 100644 --- a/crates/ffai-carmenta/Cargo.toml +++ b/crates/ffai-carmenta/Cargo.toml @@ -84,7 +84,7 @@ tokenizers = { version = "0.23", default-features = false, features = ["unstable mimalloc = { version = "0.1", default-features = false } # Superseded as the default by the pure-Rust remake; see the allocator # doc comment in `ffai-cli/src/main.rs` for the measurement. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" ffai-media = { path = "../ffai-media" } ffai-bench = { path = "../ffai-bench" } From 58d0b3480ff6dcebde48418be15fa1cf281a79e7 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:22:58 -0700 Subject: [PATCH 05/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-cli/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-cli/Cargo.toml b/crates/ffai-cli/Cargo.toml index df74d0a..2acf480 100644 --- a/crates/ffai-cli/Cargo.toml +++ b/crates/ffai-cli/Cargo.toml @@ -64,7 +64,7 @@ mimalloc = { version = "0.1", default-features = false, optional = true } # It reproduced in the CLI (which declares this allocator) and never in an # example (which declared none and got the system one), and that difference is # what finally identified it. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — see `spawn_page_trimmer` in main.rs. # Without it rusty_alloc's RSS does not bound on a rayon pool. rusty_alloc = "=2.2.0" From 4505473c4dce35604df39a8ac609f17577077cd2 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:23:00 -0700 Subject: [PATCH 06/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-diana/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-diana/Cargo.toml b/crates/ffai-diana/Cargo.toml index ccd4e14..4b85436 100644 --- a/crates/ffai-diana/Cargo.toml +++ b/crates/ffai-diana/Cargo.toml @@ -66,7 +66,7 @@ libmimalloc-sys = { version = "0.1", default-features = false } # margin the largest single effect in the Diana latency campaign (1.64x), so # it is simultaneously the dependency we most want to drop and the one that # costs the most to drop wrongly. -rusty_alloc-api = "=2.2.0" +rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — the reclaim `examples/scaling.rs` drives. # `rusty_alloc-api` deliberately exposes collect only per-`Heap`. rusty_alloc = "=2.2.0" From e1292bfd2a65ebefb9c2d190824e19a4a5d6d737 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:23:02 -0700 Subject: [PATCH 07/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-mercury-wasm/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-mercury-wasm/Cargo.toml b/crates/ffai-mercury-wasm/Cargo.toml index 45dea00..dd9234d 100644 --- a/crates/ffai-mercury-wasm/Cargo.toml +++ b/crates/ffai-mercury-wasm/Cargo.toml @@ -38,7 +38,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # Mercury's allocation pattern is its own question — one long encoder/decoder # chain rather than many small crops — so `--no-default-features` keeps the # dlmalloc arm buildable for whoever takes that measurement. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } [features] default = ["rusty-alloc"] From 67e2e0cd15dc4389241f39358b513468ad079e69 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:23:03 -0700 Subject: [PATCH 08/11] bump rusty_alloc-api to =2.2.5 --- crates/ffai-wasm/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/ffai-wasm/Cargo.toml b/crates/ffai-wasm/Cargo.toml index f153da6..cba4238 100644 --- a/crates/ffai-wasm/Cargo.toml +++ b/crates/ffai-wasm/Cargo.toml @@ -27,7 +27,7 @@ wasm-bindgen = "=0.2.121" # pinned to the installed wasm-bindgen-cli; the two # pre-reservation is disabled there, because wasm `memory.grow` is never # returned to the host). Whether it beats dlmalloc on THIS workload is a # measurement we can now run, which is the point of having a cdylib at all. -rusty_alloc-api = { version = "=2.2.0", optional = true } +rusty_alloc-api = { version = "=2.2.5", optional = true } [features] # `rusty_alloc` is the default; `--no-default-features` leaves the target's own From 0d339dbd0ef97d1a2be46ff922050c16e0513fc4 Mon Sep 17 00:00:00 2001 From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:23:05 -0700 Subject: [PATCH 09/11] add the shared portfolio check so a dependency bump can be gated on a real green --- .github/workflows/portfolio-check.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/portfolio-check.yml diff --git a/.github/workflows/portfolio-check.yml b/.github/workflows/portfolio-check.yml new file mode 100644 index 0000000..0785c32 --- /dev/null +++ b/.github/workflows/portfolio-check.yml @@ -0,0 +1,26 @@ +# Portfolio check - calls the shared harness in Remade-With-Rust/.github. +# +# Managed by remade-updater. Edit the shared workflow, not this file: this exists +# only so the run attaches to the pull request, where a merge can wait on it. + +name: portfolio-check + +on: + pull_request: + # Also on the base branch, so a red pull request can be compared against a + # real run of THIS check on main. Without it the only baseline available is + # "are main's own checks green", which answers a different question: this + # harness is stricter than most repositories' own CI, so a pre-existing + # failure it alone catches looks exactly like a regression. + push: + branches: [main, master] + workflow_dispatch: + +permissions: + contents: read + +jobs: + check: + uses: Remade-With-Rust/.github/.github/workflows/portfolio-test.yml@main + with: + command: test From 9dd51836d92711a6d76a6d3eedb1a52067e0db56 Mon Sep 17 00:00:00 2001 From: Tim Date: Thu, 8 Oct 2026 13:33:43 -0700 Subject: [PATCH 10/11] rusty_alloc =2.2.5 alongside rusty_alloc-api; Cargo.lock to match This repository pins the rusty_alloc core directly as well as the API crate. The two are released in lockstep (rusty_alloc-api 2.2.5 requires rusty_alloc 2.2.5), so the API bump the rollout made could not resolve until the core pin moved with it. Lockfile-only update for the allocator crates; the cargo-vet store (where present) covers rusty_alloc 2.2.5 the same way it covered the previous version, and trusts portable-atomic's GitHub trusted-publishing workflow (owner decision 2026-10-08, Tim Almond). Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 8 +- crates/ffai-carmenta-wasm/Cargo.toml | 2 +- crates/ffai-cli/Cargo.toml | 2 +- crates/ffai-diana/Cargo.toml | 2 +- supply-chain/audits.toml | 7 + supply-chain/config.toml | 8 +- supply-chain/imports.lock | 213 ++++++++++++++------------- 7 files changed, 125 insertions(+), 117 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 580e311..a710e1a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3974,9 +3974,9 @@ dependencies = [ [[package]] name = "rusty_alloc" -version = "2.2.0" +version = "2.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3689dec49611086f9a977596bbc1c8d7b2d1c21691438af506b793723ce16fa" +checksum = "c12ed1752127ac2fabc5bc5aed934055f4be5f093885d830a66686bff4cd7668" dependencies = [ "libc", "portable-atomic", @@ -3985,9 +3985,9 @@ dependencies = [ [[package]] name = "rusty_alloc-api" -version = "2.2.0" +version = "2.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6df579b05b731b70f98a73ec477aa889f7404be5f326da47691b32cdb94a8418" +checksum = "a68d299fc4818e1b26164556504f28240de294ea709c519ec465add9238f30f7" dependencies = [ "rusty_alloc", ] diff --git a/crates/ffai-carmenta-wasm/Cargo.toml b/crates/ffai-carmenta-wasm/Cargo.toml index 9d95e9b..397aed2 100644 --- a/crates/ffai-carmenta-wasm/Cargo.toml +++ b/crates/ffai-carmenta-wasm/Cargo.toml @@ -43,7 +43,7 @@ rusty_alloc-api = { version = "=2.2.5", optional = true } # wasm the arena is the ONLY layer that recycles a freed segment — `prim::free` # is a no-op there because linear memory cannot shrink. Same version as the # api crate, so this adds no second copy of the allocator. -rusty_alloc = { version = "=2.2.0", optional = true } +rusty_alloc = { version = "=2.2.5", optional = true } [features] # **`rusty_alloc`, and the "open measurement" this comment used to ask for has diff --git a/crates/ffai-cli/Cargo.toml b/crates/ffai-cli/Cargo.toml index 2acf480..4d75ab3 100644 --- a/crates/ffai-cli/Cargo.toml +++ b/crates/ffai-cli/Cargo.toml @@ -67,7 +67,7 @@ mimalloc = { version = "0.1", default-features = false, optional = true } rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — see `spawn_page_trimmer` in main.rs. # Without it rusty_alloc's RSS does not bound on a rayon pool. -rusty_alloc = "=2.2.0" +rusty_alloc = "=2.2.5" clap = { workspace = true } [features] diff --git a/crates/ffai-diana/Cargo.toml b/crates/ffai-diana/Cargo.toml index 4b85436..f38a536 100644 --- a/crates/ffai-diana/Cargo.toml +++ b/crates/ffai-diana/Cargo.toml @@ -69,7 +69,7 @@ libmimalloc-sys = { version = "0.1", default-features = false } rusty_alloc-api = "=2.2.5" # The core, for `alloc::collect` — the reclaim `examples/scaling.rs` drives. # `rusty_alloc-api` deliberately exposes collect only per-`Heap`. -rusty_alloc = "=2.2.0" +rusty_alloc = "=2.2.5" ffai-media = { path = "../ffai-media" } ffai-bench = { path = "../ffai-bench" } diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 99a2f00..6510f7e 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -555,6 +555,13 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2020-04-20" end = "2027-08-18" +[[trusted.portable-atomic]] +criteria = "safe-to-deploy" +trusted-publisher = "github:taiki-e/portable-atomic" +start = "2026-07-17" +end = "2027-10-08" +notes = "Owner decision 2026-10-08 (Tim Almond): trust portable-atomic's GitHub trusted-publishing workflow; target-gated dependency of rusty_alloc 2.x." + [[trusted.potential_utf]] criteria = "safe-to-deploy" user-id = 1139 # Manish Goregaokar (Manishearth) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 3b50ea6..784f06e 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -803,10 +803,6 @@ criteria = "safe-to-deploy" version = "0.3.33" criteria = "safe-to-deploy" -[[exemptions.portable-atomic]] -version = "1.14.0" -criteria = "safe-to-deploy" - [[exemptions.portable-atomic-util]] version = "0.2.7" criteria = "safe-to-deploy" @@ -984,11 +980,11 @@ version = "0.3.1" criteria = "safe-to-run" [[exemptions.rusty_alloc]] -version = "2.2.0" +version = "2.2.5" criteria = "safe-to-deploy" [[exemptions.rusty_alloc-api]] -version = "2.2.0" +version = "2.2.5" criteria = "safe-to-deploy" [[exemptions.rusty_expressions]] diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index c3a1b4b..5fbfb5a 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -510,6 +510,11 @@ user-id = 1139 user-login = "Manishearth" user-name = "Manish Goregaokar" +[[publisher.portable-atomic]] +version = "1.14.0" +when = "2026-07-17" +trusted-publisher = "github:taiki-e/portable-atomic" + [[publisher.potential_utf]] version = "0.1.5" when = "2026-04-01" @@ -2148,7 +2153,7 @@ start = "2019-03-29" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.core-graphics-types]] who = "Bobby Holley " @@ -2158,7 +2163,7 @@ start = "2020-07-20" end = "2023-05-04" renew = false notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.encoding_rs]] who = "Henri Sivonen " @@ -2167,7 +2172,7 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2019-02-26" end = "2027-09-07" notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-normalization]] who = "Manish Goregaokar " @@ -2176,7 +2181,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-11-06" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.unicode-segmentation]] who = "Manish Goregaokar " @@ -2185,7 +2190,7 @@ user-id = 1139 # Manish Goregaokar (Manishearth) start = "2019-05-15" end = "2027-04-23" notes = "All code written or reviewed by Manish" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.utf8_iter]] who = "Makoto Kato " @@ -2194,146 +2199,146 @@ user-id = 4484 # Henri Sivonen (hsivonen) start = "2022-04-19" end = "2024-06-16" notes = "Maintained by Henri Sivonen who works at Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.adler2]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.0.0 -> 2.0.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.2.18" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.allocator-api2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.2.20 -> 0.2.21" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Nicolas Silva " criteria = "safe-to-deploy" version = "0.1.2" notes = "I wrote this crate, reviewed by jimb. It is mostly a Rust port of some C++ code we already ship." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.2 -> 0.1.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.android_system_properties]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.5" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.5.2" notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.5.2 -> 0.5.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.5.3 -> 0.6.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-set]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.6.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Aria Beingessner " criteria = "safe-to-deploy" version = "0.6.3" notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.6.3 -> 0.7.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.bit-vec]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.7.0 -> 0.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.block-buffer]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.block2]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.6.2" notes = "Contains unsafe code to interoperate with the ObjC runtime." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Alex Franchuk " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.1" notes = "Very minor changes." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.cfg_aliases]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.2.1 -> 0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-foundation]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.9.3 -> 0.9.4" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-graphics-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.1.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.core-graphics-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.2 -> 0.1.3" notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.crunchy]] who = "Erich Gubler " criteria = "safe-to-deploy" version = "0.2.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.crypto-common]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.1.3 -> 0.1.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.deranged]] who = "Alex Franchuk " @@ -2344,7 +2349,7 @@ This crate contains a decent bit of `unsafe` code, however all internal unsafety is verified with copious assertions (many are compile-time), and otherwise the unsafety is documented and left to the caller to verify. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.deranged]] who = "Lars Eggert " @@ -2357,136 +2362,136 @@ who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.5.8" notes = "New unsafe code is properly guarded" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.errno]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.1 -> 0.3.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.fnv]] who = "Bobby Holley " criteria = "safe-to-deploy" version = "1.0.7" notes = "Simple hasher implementation with no unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foldhash]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.5 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foreign-types]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.3.2 -> 0.5.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.foreign-types-shared]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" version = "1.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.2.0 -> 1.2.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.form_urlencoded]] who = "edgul " criteria = "safe-to-deploy" delta = "1.2.1 -> 1.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.futures-core]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.27 -> 0.3.28" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.futures-sink]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.3.27 -> 0.3.28" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.2 -> 0.15.5" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.15.5 -> 0.16.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.0 -> 0.16.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.16.1 -> 0.17.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.17.0 -> 0.17.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "0.4.0 -> 0.5.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Henri Sivonen " criteria = "safe-to-deploy" delta = "0.5.0 -> 1.0.2" notes = "In the 0.5.0 to 1.0.2 delta, I, Henri Sivonen, rewrote the non-Punycode internals of the crate and made the changes to the Punycode code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "1.0.2 -> 1.0.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.idna]] who = "edgul " criteria = "safe-to-deploy" delta = "1.0.3 -> 1.1.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.indexmap]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "2.8.0 -> 2.11.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.indexmap]] who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "2.11.4 -> 2.14.0" notes = "Mostly internal refactorings. No new unsafe code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.libloading]] who = "Jan-Erik Rediger " @@ -2499,13 +2504,13 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.macro_rules_attribute-proc_macro]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "0.2.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.malloc_buf]] who = "Bobby Holley " @@ -2517,52 +2522,52 @@ There is an edge-case condition that passes slice::from_raw_parts(0x1, 0) which not entirely certain is technically sound, but in either case I am reasonably confident it's not exploitable. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Jim Blandy " criteria = "safe-to-deploy" version = "0.23.1" notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Jim Blandy " criteria = "safe-to-deploy" delta = "0.23.1 -> 0.24.0" notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.24.0 -> 0.25.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.25.0 -> 0.26.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Nicolas Silva , Jim Blandy " criteria = "safe-to-deploy" delta = "0.26.0 -> 0.27.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.27.0 -> 0.28.0" notes = "No significantly changed functionality. Some warnings resolved, bumped `core-graphics-types`, newer versions of Metal supported." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.metal]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.28.0 -> 0.29.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.num-conv]] who = "Alex Franchuk " @@ -2572,14 +2577,14 @@ notes = """ Very straightforward, simple crate. No dependencies, unsafe, extern, side-effectful std functions, etc. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.num-conv]] who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.2.0" notes = "Revision only removes code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-core-foundation]] who = "Andy Leiserson " @@ -2595,14 +2600,14 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-encode]] who = "Andy Leiserson " criteria = "safe-to-deploy" version = "4.1.0" notes = "Support library for objc2 with no unsafe code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-foundation]] who = "Andy Leiserson " @@ -2618,7 +2623,7 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.objc2-metal]] who = "Andy Leiserson " @@ -2634,7 +2639,7 @@ bindings. Users of this crate should be aware of the information in https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.option-ext]] who = "Nika Layzell " @@ -2646,19 +2651,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supp who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.2.0 -> 2.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "Valentin Gosu " criteria = "safe-to-deploy" delta = "2.3.0 -> 2.3.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.percent-encoding]] who = "edgul " criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.powerfmt]] who = "Alex Franchuk " @@ -2668,56 +2673,56 @@ notes = """ A tiny bit of unsafe code to implement functionality that isn't in stable rust yet, but it's all valid. Otherwise it's a pretty simple crate. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" version = "0.5.4" notes = "This is a small crate, providing safe wrappers around various low-level networking specific operating system features. Given that the Rust standard library does not provide safe wrappers for these low-level features, safe wrappers need to be build in the crate itself, i.e. `quinn-udp`, thus requiring `unsafe` code." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.4 -> 0.5.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.6 -> 0.5.8" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Inden " criteria = "safe-to-deploy" delta = "0.5.8 -> 0.5.9" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.9 -> 0.5.10" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.10 -> 0.5.11" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.11 -> 0.5.12" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quinn-udp]] who = "Max Leonard Inden " criteria = "safe-to-deploy" delta = "0.5.12 -> 0.5.13" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.quote]] who = "Jan-Erik Rediger " @@ -2739,7 +2744,7 @@ notes = """ Simple crate that extends `rand`. It has little unsafe code and uses Miri to test it. As far as I can tell, it does not have any file IO or network access. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.rustc_version]] who = "Nika Layzell " @@ -2756,19 +2761,19 @@ who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "1.0.16 -> 1.0.28" notes = "Very few changes, mostly removes support for older Rust versions. Some unsafe code refactored, but it seemed to be functionally equivalent to me." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.semver]] who = "Bobby Holley " criteria = "safe-to-deploy" delta = "1.0.17 -> 1.0.16" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sha2]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sha2]] who = "Jeff Muizelaar " @@ -2779,19 +2784,19 @@ The bulk of this is https://github.com/RustCrypto/hashes/pull/490 which adds aar I didn't check the implementation thoroughly but there wasn't anything obviously nefarious. 0.10.8 has been out for more than a year which suggests no one else has found anything either. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.sharded-slab]] who = "Mark Hammond " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.7" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Max Inden " criteria = "safe-to-deploy" delta = "1.1.0 -> 1.3.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.shlex]] who = "Emilio Cobos Álvarez " @@ -2800,51 +2805,51 @@ delta = "1.3.0 -> 2.0.1" notes = """ Mostly removes some deprecated and unsound APIs. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.simdutf8]] who = "Henri Sivonen " criteria = "safe-to-deploy" version = "0.1.5" notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.smallvec]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "1.14.0 -> 1.15.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.smallvec]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "1.15.1 -> 1.15.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strsim]] who = "Ben Dean-Kawamura " criteria = "safe-to-deploy" delta = "0.10.0 -> 0.11.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strum]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.25.0 -> 0.26.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.strum_macros]] who = "Teodor Tanasoaia " criteria = "safe-to-deploy" delta = "0.25.3 -> 0.26.4" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.subtle]] who = "Simon Friedberger " criteria = "safe-to-deploy" version = "2.5.0" notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -2855,19 +2860,19 @@ I am the primary author of the `synstructure` crate, and its current maintainer. The one use of `unsafe` is unnecessary, but documented and harmless. It will be removed in the next version. """ -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.12.6 -> 0.13.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.13.0 -> 0.13.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.synstructure]] who = "Nika Layzell " @@ -2891,19 +2896,19 @@ aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-c who = "Kershaw Chang " criteria = "safe-to-deploy" version = "0.1.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Kershaw Chang " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Alex Franchuk " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.1.2" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.time-core]] who = "Lars Eggert " @@ -2916,13 +2921,13 @@ who = "Lars Eggert " criteria = "safe-to-deploy" delta = "0.1.4 -> 0.1.8" notes = "No unsafe code" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.tinyvec_macros]] who = "Drew Willcoxon " criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.utf8parse]] who = "Nika Layzell " @@ -2941,13 +2946,13 @@ who = "Mark Hammond " criteria = "safe-to-deploy" version = "0.1.1" notes = "A microsoft crate allowing unsafe calls to windows apis." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.mozilla.audits.windows-link]] who = "Erich Gubler " criteria = "safe-to-deploy" delta = "0.1.1 -> 0.2.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" [[audits.zcash.audits.arrayref]] who = "Daira-Emma Hopwood " From 09ea326ff8d033c47acea581251358b362d07c56 Mon Sep 17 00:00:00 2001 From: Tim Date: Thu, 8 Oct 2026 14:54:37 -0700 Subject: [PATCH 11/11] ci(portfolio-check): gate on cargo check The full test suite outruns the shared portfolio workflow's 60-minute limit (cancelled at 60m on the rusty_alloc 2.2.5 rollout); FFAI's own CI already runs the tests, so the portfolio gate uses the cheap check, as the remade-updater README prescribes for very large workspaces. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/portfolio-check.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/portfolio-check.yml b/.github/workflows/portfolio-check.yml index 0785c32..46b9637 100644 --- a/.github/workflows/portfolio-check.yml +++ b/.github/workflows/portfolio-check.yml @@ -23,4 +23,6 @@ jobs: check: uses: Remade-With-Rust/.github/.github/workflows/portfolio-test.yml@main with: - command: test + # FFAI's full test suite outruns the shared workflow's 60-minute limit; + # its own CI runs the tests. The portfolio gate is the cheap `check`. + command: check