diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 2bc845439..f280b1e7b 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -206,10 +206,6 @@ criteria = "safe-to-deploy" version = "0.5.6" criteria = "safe-to-deploy" -[[exemptions.base64]] -version = "0.23.0" -criteria = "safe-to-deploy" - [[exemptions.bincode]] version = "2.0.1" criteria = "safe-to-deploy" @@ -346,10 +342,6 @@ criteria = "safe-to-deploy" version = "0.9.1" criteria = "safe-to-deploy" -[[exemptions.crypto-common]] -version = "0.1.7" -criteria = "safe-to-deploy" - [[exemptions.cty]] version = "0.2.2" criteria = "safe-to-deploy" @@ -374,10 +366,6 @@ criteria = "safe-to-deploy" version = "0.6.12" criteria = "safe-to-deploy" -[[exemptions.digest]] -version = "0.10.7" -criteria = "safe-to-deploy" - [[exemptions.dirs-sys-next]] version = "0.1.2" criteria = "safe-to-deploy" @@ -466,10 +454,6 @@ criteria = "safe-to-deploy" version = "0.3.32" criteria = "safe-to-deploy" -[[exemptions.generic-array]] -version = "0.14.7" -criteria = "safe-to-deploy" - [[exemptions.getrandom]] version = "0.2.17" criteria = "safe-to-deploy" @@ -740,7 +724,7 @@ criteria = "safe-to-deploy" [[exemptions.rand]] version = "0.9.5" -criteria = "safe-to-deploy" +criteria = "safe-to-run" [[exemptions.rand_chacha]] version = "0.10.0" @@ -1106,34 +1090,18 @@ criteria = "safe-to-deploy" version = "0.4.0" criteria = "safe-to-deploy" -[[exemptions.windows]] -version = "0.61.3" -criteria = "safe-to-deploy" - [[exemptions.windows]] version = "0.62.2" criteria = "safe-to-deploy" -[[exemptions.windows-collections]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.windows-collections]] version = "0.3.2" criteria = "safe-to-deploy" -[[exemptions.windows-core]] -version = "0.61.2" -criteria = "safe-to-deploy" - [[exemptions.windows-core]] version = "0.62.2" criteria = "safe-to-deploy" -[[exemptions.windows-future]] -version = "0.2.1" -criteria = "safe-to-deploy" - [[exemptions.windows-future]] version = "0.3.2" criteria = "safe-to-deploy" @@ -1146,26 +1114,14 @@ criteria = "safe-to-deploy" version = "0.59.3" criteria = "safe-to-deploy" -[[exemptions.windows-numerics]] -version = "0.2.0" -criteria = "safe-to-deploy" - [[exemptions.windows-numerics]] version = "0.3.1" criteria = "safe-to-deploy" -[[exemptions.windows-result]] -version = "0.3.4" -criteria = "safe-to-deploy" - [[exemptions.windows-result]] version = "0.4.1" criteria = "safe-to-deploy" -[[exemptions.windows-strings]] -version = "0.4.2" -criteria = "safe-to-deploy" - [[exemptions.windows-strings]] version = "0.5.1" criteria = "safe-to-deploy" @@ -1174,10 +1130,6 @@ criteria = "safe-to-deploy" version = "0.52.0" criteria = "safe-to-deploy" -[[exemptions.windows-sys]] -version = "0.59.0" -criteria = "safe-to-deploy" - [[exemptions.windows-sys]] version = "0.61.2" criteria = "safe-to-deploy" @@ -1186,10 +1138,6 @@ criteria = "safe-to-deploy" version = "0.52.6" criteria = "safe-to-deploy" -[[exemptions.windows-threading]] -version = "0.1.0" -criteria = "safe-to-deploy" - [[exemptions.windows-threading]] version = "0.2.1" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 5bb4979ac..b309c315e 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -466,13 +466,6 @@ user-id = 359 user-login = "seanmonstar" user-name = "Sean McArthur" -[[publisher.reqwest]] -version = "0.13.4" -when = "2026-05-25" -user-id = 359 -user-login = "seanmonstar" -user-name = "Sean McArthur" - [[publisher.rustversion]] version = "1.0.23" when = "2026-07-07" @@ -750,11 +743,6 @@ criteria = "safe-to-deploy" version = "1.1.2" notes = "Contains `unsafe` code but it's well-documented and scoped to what it's intended to be doing. Otherwise a well-focused and straightforward crate." -[[audits.bytecode-alliance.audits.block-buffer]] -who = "Benjamin Bouvier " -criteria = "safe-to-deploy" -delta = "0.9.0 -> 0.10.2" - [[audits.bytecode-alliance.audits.cfg-if]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -1346,11 +1334,6 @@ who = "David Cook " criteria = "safe-to-run" version = "0.4.0" -[[audits.isrg.audits.block-buffer]] -who = "David Cook " -criteria = "safe-to-deploy" -version = "0.9.0" - [[audits.isrg.audits.cfg-if]] who = "David Cook " criteria = "safe-to-deploy" @@ -1447,16 +1430,6 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.12.1 -> 1.13.0" -[[audits.isrg.audits.sha2]] -who = "David Cook " -criteria = "safe-to-deploy" -version = "0.10.2" - -[[audits.isrg.audits.sha2]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "0.10.8 -> 0.10.9" - [[audits.isrg.audits.subtle]] who = "David Cook " criteria = "safe-to-deploy" @@ -1579,12 +1552,6 @@ criteria = "safe-to-deploy" delta = "0.7.0 -> 0.8.0" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.block-buffer]] -who = "Mike Hommey " -criteria = "safe-to-deploy" -delta = "0.10.2 -> 0.10.3" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.cfg_aliases]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -1899,33 +1866,6 @@ criteria = "safe-to-deploy" delta = "1.3.0 -> 1.3.1" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -[[audits.mozilla.audits.rustc_version]] -who = "Nika Layzell " -criteria = "safe-to-deploy" -version = "0.4.0" -notes = """ -Use of powerful capabilities is limited to invoking `rustc -vV` to get version -information for parsing version information. -""" -aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.sha2]] -who = "Mike Hommey " -criteria = "safe-to-deploy" -delta = "0.10.2 -> 0.10.6" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.sha2]] -who = "Jeff Muizelaar " -criteria = "safe-to-deploy" -delta = "0.10.6 -> 0.10.8" -notes = """ -The bulk of this is https://github.com/RustCrypto/hashes/pull/490 which adds aarch64 support along with another PR adding longson. -I didn't check the implementation thoroughly but there wasn't anything obviously nefarious. 0.10.8 has been out for more than a year -which suggests no one else has found anything either. -""" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.sharded-slab]] who = "Mark Hammond " criteria = "safe-to-deploy" @@ -2099,13 +2039,6 @@ delta = "1.4.0 -> 1.5.0" notes = "Filesystem change is to remove the generated LLVM IR output file after probing." aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.block-buffer]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "0.10.3 -> 0.10.4" -notes = "Adds panics to prevent a block size of zero from causing unsoundness." -aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" - [[audits.zcash.audits.crunchy]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -2165,13 +2098,6 @@ criteria = "safe-to-deploy" version = "0.3.0" aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.rustc_version]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "0.4.0 -> 0.4.1" -notes = "Changes to `Command` usage are to add support for `RUSTC_WRAPPER`." -aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" - [[audits.zcash.audits.strum_macros]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -2202,12 +2128,6 @@ Migrates to `try-lock 0.2.4` to replace some unsafe APIs that were not marked """ aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.windows-link]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "0.1.1 -> 0.1.3" -aggregated-from = "https://raw.githubusercontent.com/zcash/librustzcash/main/supply-chain/audits.toml" - [[audits.zcash.audits.windows-link]] who = "Jack Grigg " criteria = "safe-to-deploy"