2 # cargo-vet imports lock
4 [[publisher.aho-corasick]]
8 user-login = "BurntSushi"
9 user-name = "Andrew Gallant"
11 [[publisher.aho-corasick]]
15 user-login = "BurntSushi"
16 user-name = "Andrew Gallant"
25 [[publisher.arbitrary]]
29 user-login = "fitzgen"
30 user-name = "Nick Fitzgerald"
32 [[publisher.async-trait]]
36 user-login = "dtolnay"
37 user-name = "David Tolnay"
43 user-login = "Amanieu"
44 user-name = "Amanieu d'Antras"
46 [[publisher.audio_thread_priority]]
50 user-login = "padenot"
51 user-name = "Paul Adenot"
53 [[publisher.authenticator]]
54 version = "0.4.0-alpha.23"
57 user-login = "jschanck"
58 user-name = "John Schanck"
60 [[publisher.authenticator]]
61 version = "0.4.0-alpha.24"
64 user-login = "jschanck"
65 user-name = "John Schanck"
71 user-login = "martinthomson"
72 user-name = "Martin Thomson"
74 [[publisher.byteorder]]
78 user-login = "BurntSushi"
79 user-name = "Andrew Gallant"
85 user-login = "Darksonn"
86 user-name = "Alice Ryhl"
93 user-name = "Emilio Cobos Álvarez"
100 user-name = "Ed Page"
102 [[publisher.clap_builder]]
107 user-name = "Ed Page"
109 [[publisher.clap_derive]]
114 user-name = "Ed Page"
116 [[publisher.clap_lex]]
121 user-name = "Ed Page"
123 [[publisher.core-foundation]]
127 user-login = "jrmuizel"
128 user-name = "Jeff Muizelaar"
130 [[publisher.core-foundation-sys]]
135 user-name = "Josh Matthews"
137 [[publisher.core-graphics]]
141 user-login = "jrmuizel"
142 user-name = "Jeff Muizelaar"
144 [[publisher.core-graphics-types]]
149 user-name = "Josh Matthews"
151 [[publisher.core-text]]
155 user-login = "jrmuizel"
156 user-name = "Jeff Muizelaar"
158 [[publisher.derive_arbitrary]]
162 user-login = "fitzgen"
163 user-name = "Nick Fitzgerald"
169 user-login = "linabutler"
170 user-name = "Lina Butler"
176 user-login = "dtolnay"
177 user-name = "David Tolnay"
179 [[publisher.encoding_rs]]
183 user-login = "hsivonen"
184 user-name = "Henri Sivonen"
186 [[publisher.etagere]]
191 user-name = "Nicolas Silva"
198 user-name = "Nicolas Silva"
204 user-login = "joshtriplett"
205 user-name = "Josh Triplett"
207 [[publisher.freetype]]
212 user-name = "Josh Matthews"
218 user-login = "jrmuizel"
219 user-name = "Jeff Muizelaar"
225 user-login = "badboy"
226 user-name = "Jan-Erik Rediger"
232 user-login = "badboy"
233 user-name = "Jan-Erik Rediger"
235 [[publisher.glean-core]]
239 user-login = "badboy"
240 user-name = "Jan-Erik Rediger"
242 [[publisher.glean-core]]
246 user-login = "badboy"
247 user-name = "Jan-Erik Rediger"
249 [[publisher.glslopt]]
253 user-login = "jamienicol"
254 user-name = "Jamie Nicol"
260 user-login = "seanmonstar"
261 user-name = "Sean McArthur"
263 [[publisher.headers]]
267 user-login = "seanmonstar"
268 user-name = "Sean McArthur"
270 [[publisher.httparse]]
274 user-login = "seanmonstar"
275 user-name = "Sean McArthur"
277 [[publisher.indexmap]]
281 user-login = "cuviper"
282 user-name = "Josh Stone"
284 [[publisher.inherent]]
288 user-login = "dtolnay"
289 user-name = "David Tolnay"
295 user-login = "carllerche"
296 user-name = "Carl Lerche"
302 user-login = "dtolnay"
303 user-name = "David Tolnay"
305 [[publisher.jobserver]]
309 user-login = "alexcrichton"
310 user-name = "Alex Crichton"
316 user-login = "Amanieu"
317 user-name = "Amanieu d'Antras"
323 user-login = "JohnTitor"
324 user-name = "Yuki Okushi"
326 [[publisher.linux-raw-sys]]
330 user-login = "sunfishcode"
331 user-name = "Dan Gohman"
333 [[publisher.lock_api]]
337 user-login = "Amanieu"
338 user-name = "Amanieu d'Antras"
344 user-login = "BurntSushi"
345 user-name = "Andrew Gallant"
351 user-login = "seanmonstar"
352 user-name = "Sean McArthur"
358 user-login = "carllerche"
359 user-name = "Carl Lerche"
361 [[publisher.nss-gk-api]]
365 user-login = "jschanck"
366 user-name = "John Schanck"
368 [[publisher.num_cpus]]
372 user-login = "seanmonstar"
373 user-name = "Sean McArthur"
379 user-login = "martinthomson"
380 user-name = "Martin Thomson"
382 [[publisher.ordered-float]]
386 user-login = "mbrubeck"
387 user-name = "Matt Brubeck"
389 [[publisher.parking_lot]]
393 user-login = "Amanieu"
394 user-name = "Amanieu d'Antras"
396 [[publisher.parking_lot_core]]
400 user-login = "Amanieu"
401 user-name = "Amanieu d'Antras"
407 user-login = "dtolnay"
408 user-name = "David Tolnay"
414 user-login = "le-automaton"
420 user-login = "divviup-github-automation"
422 [[publisher.proc-macro2]]
426 user-login = "dtolnay"
427 user-name = "David Tolnay"
429 [[publisher.proc-macro2]]
433 user-login = "dtolnay"
434 user-name = "David Tolnay"
436 [[publisher.proc-macro2]]
440 user-login = "dtolnay"
441 user-name = "David Tolnay"
447 user-login = "dtolnay"
448 user-name = "David Tolnay"
454 user-login = "dtolnay"
455 user-name = "David Tolnay"
461 user-login = "BurntSushi"
462 user-name = "Andrew Gallant"
468 user-login = "BurntSushi"
469 user-name = "Andrew Gallant"
471 [[publisher.regex-automata]]
475 user-login = "BurntSushi"
476 user-name = "Andrew Gallant"
478 [[publisher.regex-syntax]]
482 user-login = "BurntSushi"
483 user-name = "Andrew Gallant"
485 [[publisher.regex-syntax]]
489 user-login = "BurntSushi"
490 user-name = "Andrew Gallant"
492 [[publisher.rust_cascade]]
496 user-login = "mozkeeler"
497 user-name = "Dana Keeler"
503 user-login = "sunfishcode"
504 user-name = "Dan Gohman"
510 user-login = "dtolnay"
511 user-name = "David Tolnay"
513 [[publisher.same-file]]
517 user-login = "BurntSushi"
518 user-name = "Andrew Gallant"
520 [[publisher.scopeguard]]
524 user-login = "Amanieu"
525 user-name = "Amanieu d'Antras"
531 user-login = "dtolnay"
532 user-name = "David Tolnay"
538 user-login = "dtolnay"
539 user-name = "David Tolnay"
545 user-login = "dtolnay"
546 user-name = "David Tolnay"
552 user-login = "dtolnay"
553 user-name = "David Tolnay"
555 [[publisher.serde_bytes]]
559 user-login = "dtolnay"
560 user-name = "David Tolnay"
562 [[publisher.serde_derive]]
566 user-login = "dtolnay"
567 user-name = "David Tolnay"
569 [[publisher.serde_derive]]
573 user-login = "dtolnay"
574 user-name = "David Tolnay"
576 [[publisher.serde_derive]]
580 user-login = "dtolnay"
581 user-name = "David Tolnay"
583 [[publisher.serde_derive]]
587 user-login = "dtolnay"
588 user-name = "David Tolnay"
590 [[publisher.serde_json]]
594 user-login = "dtolnay"
595 user-name = "David Tolnay"
597 [[publisher.serde_repr]]
601 user-login = "dtolnay"
602 user-name = "David Tolnay"
604 [[publisher.serde_yaml]]
608 user-login = "dtolnay"
609 user-name = "David Tolnay"
611 [[publisher.smallvec]]
615 user-login = "mbrubeck"
616 user-name = "Matt Brubeck"
622 user-login = "dtolnay"
623 user-name = "David Tolnay"
629 user-login = "dtolnay"
630 user-name = "David Tolnay"
636 user-login = "dtolnay"
637 user-name = "David Tolnay"
639 [[publisher.termcolor]]
643 user-login = "BurntSushi"
644 user-name = "Andrew Gallant"
646 [[publisher.termcolor]]
650 user-login = "BurntSushi"
651 user-name = "Andrew Gallant"
653 [[publisher.thiserror]]
657 user-login = "dtolnay"
658 user-name = "David Tolnay"
660 [[publisher.thiserror-impl]]
664 user-login = "dtolnay"
665 user-name = "David Tolnay"
667 [[publisher.threadbound]]
671 user-login = "dtolnay"
672 user-name = "David Tolnay"
674 [[publisher.tokio-util]]
678 user-login = "Darksonn"
679 user-name = "Alice Ryhl"
685 user-login = "alexcrichton"
686 user-name = "Alex Crichton"
688 [[publisher.unicode-ident]]
692 user-login = "dtolnay"
693 user-name = "David Tolnay"
695 [[publisher.unicode-segmentation]]
699 user-login = "Manishearth"
700 user-name = "Manish Goregaokar"
702 [[publisher.unicode-width]]
706 user-login = "Manishearth"
707 user-name = "Manish Goregaokar"
709 [[publisher.unicode-xid]]
713 user-login = "Manishearth"
714 user-name = "Manish Goregaokar"
720 user-login = "badboy"
721 user-name = "Jan-Erik Rediger"
727 user-login = "mhammond"
728 user-name = "Mark Hammond"
736 [[publisher.uniffi_bindgen]]
740 user-login = "badboy"
741 user-name = "Jan-Erik Rediger"
743 [[publisher.uniffi_bindgen]]
747 user-login = "mhammond"
748 user-name = "Mark Hammond"
750 [[publisher.uniffi_bindgen]]
756 [[publisher.uniffi_build]]
760 user-login = "badboy"
761 user-name = "Jan-Erik Rediger"
763 [[publisher.uniffi_build]]
767 user-login = "mhammond"
768 user-name = "Mark Hammond"
770 [[publisher.uniffi_build]]
776 [[publisher.uniffi_checksum_derive]]
780 user-login = "badboy"
781 user-name = "Jan-Erik Rediger"
783 [[publisher.uniffi_checksum_derive]]
787 user-login = "mhammond"
788 user-name = "Mark Hammond"
790 [[publisher.uniffi_checksum_derive]]
796 [[publisher.uniffi_core]]
800 user-login = "badboy"
801 user-name = "Jan-Erik Rediger"
803 [[publisher.uniffi_core]]
807 user-login = "mhammond"
808 user-name = "Mark Hammond"
810 [[publisher.uniffi_core]]
816 [[publisher.uniffi_macros]]
820 user-login = "badboy"
821 user-name = "Jan-Erik Rediger"
823 [[publisher.uniffi_macros]]
827 user-login = "mhammond"
828 user-name = "Mark Hammond"
830 [[publisher.uniffi_macros]]
836 [[publisher.uniffi_meta]]
840 user-login = "badboy"
841 user-name = "Jan-Erik Rediger"
843 [[publisher.uniffi_meta]]
847 user-login = "mhammond"
848 user-name = "Mark Hammond"
850 [[publisher.uniffi_meta]]
856 [[publisher.uniffi_testing]]
860 user-login = "badboy"
861 user-name = "Jan-Erik Rediger"
863 [[publisher.uniffi_testing]]
867 user-login = "mhammond"
868 user-name = "Mark Hammond"
870 [[publisher.uniffi_testing]]
876 [[publisher.uniffi_udl]]
880 user-login = "mhammond"
881 user-name = "Mark Hammond"
883 [[publisher.uniffi_udl]]
889 [[publisher.utf8_iter]]
893 user-login = "hsivonen"
894 user-name = "Henri Sivonen"
896 [[publisher.walkdir]]
900 user-login = "BurntSushi"
901 user-name = "Andrew Gallant"
907 user-login = "seanmonstar"
908 user-name = "Sean McArthur"
914 user-login = "seanmonstar"
915 user-name = "Sean McArthur"
918 version = "0.11.0+wasi-snapshot-preview1"
921 user-login = "alexcrichton"
922 user-name = "Alex Crichton"
924 [[publisher.wasm-encoder]]
928 user-login = "alexcrichton"
929 user-name = "Alex Crichton"
931 [[publisher.wasm-encoder]]
935 user-login = "alexcrichton"
936 user-name = "Alex Crichton"
938 [[publisher.wasm-smith]]
942 user-login = "alexcrichton"
943 user-name = "Alex Crichton"
945 [[publisher.wasm-smith]]
949 user-login = "alexcrichton"
950 user-name = "Alex Crichton"
956 user-login = "alexcrichton"
957 user-name = "Alex Crichton"
963 user-login = "alexcrichton"
964 user-name = "Alex Crichton"
966 [[publisher.winapi-util]]
970 user-login = "BurntSushi"
971 user-name = "Andrew Gallant"
973 [[publisher.windows-sys]]
977 user-login = "kennykerr"
978 user-name = "Kenny Kerr"
980 [[publisher.zeitstempel]]
984 user-login = "badboy"
985 user-name = "Jan-Erik Rediger"
987 [[audits.bytecode-alliance.wildcard-audits.arbitrary]]
988 who = "Nick Fitzgerald <fitzgen@gmail.com>"
989 criteria = "safe-to-deploy"
990 user-id = 696 # Nick Fitzgerald (fitzgen)
993 notes = "I am an author of this crate."
995 [[audits.bytecode-alliance.wildcard-audits.derive_arbitrary]]
996 who = "Nick Fitzgerald <fitzgen@gmail.com>"
997 criteria = "safe-to-deploy"
998 user-id = 696 # Nick Fitzgerald (fitzgen)
1001 notes = "I am an author of this crate"
1003 [[audits.bytecode-alliance.wildcard-audits.wasm-encoder]]
1004 who = "Alex Crichton <alex@alexcrichton.com>"
1005 criteria = "safe-to-deploy"
1006 user-id = 1 # Alex Crichton (alexcrichton)
1007 start = "2020-12-11"
1010 This is a Bytecode Alliance authored crate maintained in the `wasm-tools`
1011 repository of which I'm one of the primary maintainers and publishers for.
1012 I am employed by a member of the Bytecode Alliance and plan to continue doing
1013 so and will actively maintain this crate over time.
1016 [[audits.bytecode-alliance.wildcard-audits.wasm-smith]]
1017 who = "Alex Crichton <alex@alexcrichton.com>"
1018 criteria = "safe-to-deploy"
1019 user-id = 1 # Alex Crichton (alexcrichton)
1020 start = "2020-09-03"
1023 This is a Bytecode Alliance authored crate maintained in the `wasm-tools`
1024 repository of which I'm one of the primary maintainers and publishers for.
1025 I am employed by a member of the Bytecode Alliance and plan to continue doing
1026 so and will actively maintain this crate over time.
1029 [[audits.bytecode-alliance.wildcard-audits.wasmparser]]
1030 who = "Alex Crichton <alex@alexcrichton.com>"
1031 criteria = "safe-to-deploy"
1032 user-id = 1 # Alex Crichton (alexcrichton)
1033 start = "2020-07-13"
1036 This is a Bytecode Alliance authored crate maintained in the `wasm-tools`
1037 repository of which I'm one of the primary maintainers and publishers for.
1038 I am employed by a member of the Bytecode Alliance and plan to continue doing
1039 so and will actively maintain this crate over time.
1042 [[audits.bytecode-alliance.wildcard-audits.wast]]
1043 who = "Alex Crichton <alex@alexcrichton.com>"
1044 criteria = "safe-to-deploy"
1045 user-id = 1 # Alex Crichton (alexcrichton)
1046 start = "2019-10-16"
1049 This is a Bytecode Alliance authored crate maintained in the `wasm-tools`
1050 repository of which I'm one of the primary maintainers and publishers for.
1051 I am employed by a member of the Bytecode Alliance and plan to continue doing
1052 so and will actively maintain this crate over time.
1055 [[audits.bytecode-alliance.audits.adler]]
1056 who = "Alex Crichton <alex@alexcrichton.com>"
1057 criteria = "safe-to-deploy"
1059 notes = "This is a small crate which forbids unsafe code and is a straightforward implementation of the adler hashing algorithm."
1061 [[audits.bytecode-alliance.audits.arrayref]]
1062 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1063 criteria = "safe-to-deploy"
1066 Unsafe code, but its logic looks good to me. Necessary given what it is
1067 doing. Well tested, has quickchecks.
1070 [[audits.bytecode-alliance.audits.arrayvec]]
1071 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1072 criteria = "safe-to-deploy"
1075 Well documented invariants, good assertions for those invariants in unsafe code,
1076 and tested with MIRI to boot. LGTM.
1079 [[audits.bytecode-alliance.audits.base64]]
1080 who = "Pat Hickey <phickey@fastly.com>"
1081 criteria = "safe-to-deploy"
1083 notes = "This crate has no dependencies, no build.rs, and contains no unsafe code."
1085 [[audits.bytecode-alliance.audits.bitflags]]
1086 who = "Jamey Sharp <jsharp@fastly.com>"
1087 criteria = "safe-to-deploy"
1088 delta = "2.1.0 -> 2.2.1"
1090 This version adds unsafe impls of traits from the bytemuck crate when built
1091 with that library enabled, but I believe the impls satisfy the documented
1092 safety requirements for bytemuck. The other changes are minor.
1095 [[audits.bytecode-alliance.audits.bitflags]]
1096 who = "Alex Crichton <alex@alexcrichton.com>"
1097 criteria = "safe-to-deploy"
1098 delta = "2.3.2 -> 2.3.3"
1100 Nothing outside the realm of what one would expect from a bitflags generator,
1104 [[audits.bytecode-alliance.audits.block-buffer]]
1105 who = "Benjamin Bouvier <public@benj.me>"
1106 criteria = "safe-to-deploy"
1107 delta = "0.9.0 -> 0.10.2"
1109 [[audits.bytecode-alliance.audits.bumpalo]]
1110 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1111 criteria = "safe-to-deploy"
1113 notes = "I am the author of this crate."
1115 [[audits.bytecode-alliance.audits.cargo-platform]]
1116 who = "Pat Hickey <phickey@fastly.com>"
1117 criteria = "safe-to-deploy"
1119 notes = "no build, no ambient capabilities, no unsafe"
1121 [[audits.bytecode-alliance.audits.cc]]
1122 who = "Alex Crichton <alex@alexcrichton.com>"
1123 criteria = "safe-to-deploy"
1125 notes = "I am the author of this crate."
1127 [[audits.bytecode-alliance.audits.cfg-if]]
1128 who = "Alex Crichton <alex@alexcrichton.com>"
1129 criteria = "safe-to-deploy"
1131 notes = "I am the author of this crate."
1133 [[audits.bytecode-alliance.audits.codespan-reporting]]
1134 who = "Jamey Sharp <jsharp@fastly.com>"
1135 criteria = "safe-to-deploy"
1137 notes = "This library uses `forbid(unsafe_code)` and has no filesystem or network I/O."
1139 [[audits.bytecode-alliance.audits.cpufeatures]]
1140 who = "Alex Crichton <alex@alexcrichton.com>"
1141 criteria = "safe-to-deploy"
1142 delta = "0.2.2 -> 0.2.7"
1144 This is a minor update that looks to add some more detected CPU features and
1145 various other minor portability fixes such as MIRI support.
1148 [[audits.bytecode-alliance.audits.crypto-common]]
1149 who = "Benjamin Bouvier <public@benj.me>"
1150 criteria = "safe-to-deploy"
1153 [[audits.bytecode-alliance.audits.errno]]
1154 who = "Dan Gohman <dev@sunfishcode.online>"
1155 criteria = "safe-to-deploy"
1157 notes = "This crate uses libc and windows-sys APIs to get and set the raw OS error value."
1159 [[audits.bytecode-alliance.audits.errno]]
1160 who = "Dan Gohman <dev@sunfishcode.online>"
1161 criteria = "safe-to-deploy"
1162 delta = "0.3.0 -> 0.3.1"
1163 notes = "Just a dependency version bump and a bug fix for redox"
1165 [[audits.bytecode-alliance.audits.errno-dragonfly]]
1166 who = "Jamey Sharp <jsharp@fastly.com>"
1167 criteria = "safe-to-deploy"
1169 notes = "This should be portable to any POSIX system and seems like it should be part of the libc crate, but at any rate it's safe as is."
1171 [[audits.bytecode-alliance.audits.foreign-types]]
1172 who = "Pat Hickey <phickey@fastly.com>"
1173 criteria = "safe-to-deploy"
1175 notes = "This crate defined a macro-rules which creates wrappers working with FFI types. The implementation of this crate appears to be safe, but each use of this macro would need to be vetted for correctness as well."
1177 [[audits.bytecode-alliance.audits.foreign-types-shared]]
1178 who = "Pat Hickey <phickey@fastly.com>"
1179 criteria = "safe-to-deploy"
1182 [[audits.bytecode-alliance.audits.futures-channel]]
1183 who = "Pat Hickey <phickey@fastly.com>"
1184 criteria = "safe-to-deploy"
1186 notes = "build.rs is just detecting the target and setting cfg. unsafety is for implementing a concurrency primitives using atomics and unsafecell, and is not obviously incorrect (this is the sort of thing I wouldn't certify as correct without formal methods)"
1188 [[audits.bytecode-alliance.audits.futures-core]]
1189 who = "Pat Hickey <phickey@fastly.com>"
1190 criteria = "safe-to-deploy"
1192 notes = "Unsafe used to implement a concurrency primitive AtomicWaker. Well-commented and not obviously incorrect. Like my other audits of these concurrency primitives inside the futures family, I couldn't certify that it is correct without formal methods, but that is out of scope for this vetting."
1194 [[audits.bytecode-alliance.audits.futures-executor]]
1195 who = "Pat Hickey <phickey@fastly.com>"
1196 criteria = "safe-to-deploy"
1198 notes = "Unsafe used to implement the unpark mutex, which is well commented and not obviously incorrect. Like with futures-channel I wouldn't be able to certify it as correct without formal methods."
1200 [[audits.bytecode-alliance.audits.futures-io]]
1201 who = "Pat Hickey <phickey@fastly.com>"
1202 criteria = "safe-to-deploy"
1205 [[audits.bytecode-alliance.audits.futures-sink]]
1206 who = "Pat Hickey <phickey@fastly.com>"
1207 criteria = "safe-to-deploy"
1210 [[audits.bytecode-alliance.audits.heck]]
1211 who = "Alex Crichton <alex@alexcrichton.com>"
1212 criteria = "safe-to-deploy"
1214 notes = "Contains `forbid_unsafe` and only uses `std::fmt` from the standard library. Otherwise only contains string manipulation."
1216 [[audits.bytecode-alliance.audits.id-arena]]
1217 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1218 criteria = "safe-to-deploy"
1220 notes = "I am the author of this crate."
1222 [[audits.bytecode-alliance.audits.idna]]
1223 who = "Alex Crichton <alex@alexcrichton.com>"
1224 criteria = "safe-to-deploy"
1227 This is a crate without unsafe code or usage of the standard library. The large
1228 size of this crate comes from the large generated unicode tables file. This
1229 crate is broadly used throughout the ecosystem and does not contain anything
1233 [[audits.bytecode-alliance.audits.leb128]]
1234 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1235 criteria = "safe-to-deploy"
1237 notes = "I am the author of this crate."
1239 [[audits.bytecode-alliance.audits.libc]]
1240 who = "Alex Crichton <alex@alexcrichton.com>"
1241 criteria = "safe-to-deploy"
1242 delta = "0.2.146 -> 0.2.147"
1243 notes = "Only new type definitions and updating others for some platforms, no major changes"
1245 [[audits.bytecode-alliance.audits.memoffset]]
1246 who = "Alex Crichton <alex@alexcrichton.com>"
1247 criteria = "safe-to-deploy"
1248 delta = "0.7.1 -> 0.8.0"
1249 notes = "This was a small update to the crate which has to do with Rust language features and compiler versions, no substantial changes."
1251 [[audits.bytecode-alliance.audits.miniz_oxide]]
1252 who = "Alex Crichton <alex@alexcrichton.com>"
1253 criteria = "safe-to-deploy"
1256 This crate is a Rust implementation of zlib compression/decompression and has
1257 been used by default by the Rust standard library for quite some time. It's also
1258 a default dependency of the popular `backtrace` crate for decompressing debug
1259 information. This crate forbids unsafe code and does not otherwise access system
1260 resources. It's originally a port of the `miniz.c` library as well, and given
1261 its own longevity should be relatively hardened against some of the more common
1262 compression-related issues.
1265 [[audits.bytecode-alliance.audits.mio]]
1266 who = "Alex Crichton <alex@alexcrichton.com>"
1267 criteria = "safe-to-deploy"
1268 delta = "0.8.6 -> 0.8.8"
1269 notes = "Mostly OS portability updates along with some minor bugfixes."
1271 [[audits.bytecode-alliance.audits.object]]
1272 who = "Alex Crichton <alex@alexcrichton.com>"
1273 criteria = "safe-to-deploy"
1274 delta = "0.30.3 -> 0.31.1"
1275 notes = "A large-ish update to the crate but nothing out of the ordering. Support for new formats like xcoff, new constants, minor refactorings, etc. Nothing out of the ordinary."
1277 [[audits.bytecode-alliance.audits.object]]
1278 who = "Alex Crichton <alex@alexcrichton.com>"
1279 criteria = "safe-to-deploy"
1280 delta = "0.31.1 -> 0.32.0"
1281 notes = "Various new features and refactorings as one would expect from an object parsing crate, all looks good."
1283 [[audits.bytecode-alliance.audits.peeking_take_while]]
1284 who = "Nick Fitzgerald <fitzgen@gmail.com>"
1285 criteria = "safe-to-deploy"
1287 notes = "I am the author of this crate."
1289 [[audits.bytecode-alliance.audits.percent-encoding]]
1290 who = "Alex Crichton <alex@alexcrichton.com>"
1291 criteria = "safe-to-deploy"
1294 This crate is a single-file crate that does what it says on the tin. There are
1295 a few `unsafe` blocks related to utf-8 validation which are locally verifiable
1296 as correct and otherwise this crate is good to go.
1299 [[audits.bytecode-alliance.audits.pin-utils]]
1300 who = "Pat Hickey <phickey@fastly.com>"
1301 criteria = "safe-to-deploy"
1304 [[audits.bytecode-alliance.audits.pkg-config]]
1305 who = "Pat Hickey <phickey@fastly.com>"
1306 criteria = "safe-to-deploy"
1308 notes = "This crate shells out to the pkg-config executable, but it appears to sanitize inputs reasonably."
1310 [[audits.bytecode-alliance.audits.rustc-demangle]]
1311 who = "Alex Crichton <alex@alexcrichton.com>"
1312 criteria = "safe-to-deploy"
1314 notes = "I am the author of this crate."
1316 [[audits.bytecode-alliance.audits.semver]]
1317 who = "Pat Hickey <phickey@fastly.com>"
1318 criteria = "safe-to-deploy"
1320 notes = "plenty of unsafe pointer and vec tricks, but in well-structured and commented code that appears to be correct"
1322 [[audits.bytecode-alliance.audits.slab]]
1323 who = "Pat Hickey <phickey@fastly.com>"
1324 criteria = "safe-to-deploy"
1326 notes = "provides a datastructure implemented using std's Vec. all uses of unsafe are just delegating to the underlying unsafe Vec methods."
1328 [[audits.bytecode-alliance.audits.socket2]]
1329 who = "Alex Crichton <alex@alexcrichton.com>"
1330 criteria = "safe-to-deploy"
1331 delta = "0.4.7 -> 0.4.9"
1332 notes = "Minor OS compat updates but otherwise nothing major here."
1334 [[audits.bytecode-alliance.audits.tempfile]]
1335 who = "Pat Hickey <phickey@fastly.com>"
1336 criteria = "safe-to-deploy"
1337 delta = "3.3.0 -> 3.5.0"
1339 [[audits.bytecode-alliance.audits.tempfile]]
1340 who = "Alex Crichton <alex@alexcrichton.com>"
1341 criteria = "safe-to-deploy"
1342 delta = "3.5.0 -> 3.6.0"
1343 notes = "Dependency updates and new optimized trait implementations, but otherwise everything looks normal."
1345 [[audits.bytecode-alliance.audits.unicase]]
1346 who = "Alex Crichton <alex@alexcrichton.com>"
1347 criteria = "safe-to-deploy"
1350 This crate contains no `unsafe` code and no unnecessary use of the standard
1354 [[audits.bytecode-alliance.audits.unicode-bidi]]
1355 who = "Alex Crichton <alex@alexcrichton.com>"
1356 criteria = "safe-to-deploy"
1359 This crate has no unsafe code and does not use `std::*`. Skimming the crate it
1360 does not attempt to out of the bounds of what it's already supposed to be doing.
1363 [[audits.bytecode-alliance.audits.unicode-normalization]]
1364 who = "Alex Crichton <alex@alexcrichton.com>"
1365 criteria = "safe-to-deploy"
1368 This crate contains one usage of `unsafe` which I have manually checked to see
1369 it as correct. This crate's size comes in large part due to the generated
1370 unicode tables that it contains. This crate is additionally widely used
1371 throughout the ecosystem and skimming the crate shows no usage of `std::*` APIs
1372 and nothing suspicious.
1375 [[audits.embark-studios.audits.anyhow]]
1376 who = "Johan Andersson <opensource@embark-studios.com>"
1377 criteria = "safe-to-deploy"
1380 [[audits.embark-studios.audits.derive_more]]
1381 who = "Johan Andersson <opensource@embark-studios.com>"
1382 criteria = "safe-to-deploy"
1384 notes = "No unsafe usage or ambient capabilities"
1386 [[audits.embark-studios.audits.ident_case]]
1387 who = "Johan Andersson <opensource@embark-studios.com>"
1388 criteria = "safe-to-deploy"
1390 notes = "No unsafe usage or ambient capabilities"
1392 [[audits.embark-studios.audits.idna]]
1393 who = "Johan Andersson <opensource@embark-studios.com>"
1394 criteria = "safe-to-deploy"
1395 delta = "0.3.0 -> 0.4.0"
1396 notes = "No unsafe usage or ambient capabilities"
1398 [[audits.embark-studios.audits.line-wrap]]
1399 who = "Johan Andersson <opensource@embark-studios.com>"
1400 criteria = "safe-to-deploy"
1402 notes = "No unsafe usage or ambient capabilities"
1404 [[audits.embark-studios.audits.thiserror]]
1405 who = "Johan Andersson <opensource@embark-studios.com>"
1406 criteria = "safe-to-deploy"
1408 notes = "Wrapper over implementation crate, found no unsafe or ambient capabilities used"
1410 [[audits.embark-studios.audits.thiserror-impl]]
1411 who = "Johan Andersson <opensource@embark-studios.com>"
1412 criteria = "safe-to-deploy"
1414 notes = "Found no unsafe or ambient capabilities used"
1416 [[audits.embark-studios.audits.yaml-rust]]
1417 who = "Johan Andersson <opensource@embark-studios.com>"
1418 criteria = "safe-to-deploy"
1420 notes = "No unsafe usage or ambient capabilities"
1422 [[audits.google.audits.ash]]
1423 who = "David Koloski <dkoloski@google.com>"
1424 criteria = "safe-to-deploy"
1425 version = "0.37.0+1.3.209"
1426 notes = "Reviewed on https://fxrev.dev/694269"
1427 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1429 [[audits.google.audits.fastrand]]
1430 who = "George Burgess IV <gbiv@google.com>"
1431 criteria = "safe-to-deploy"
1434 `does-not-implement-crypto` is certified because this crate explicitly says
1435 that the RNG here is not cryptographically secure.
1437 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1439 [[audits.google.audits.futures]]
1440 who = "George Burgess IV <gbiv@google.com>"
1441 criteria = "safe-to-deploy"
1444 `futures` has no logic other than tests - it simply `pub use`s things from
1447 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1449 [[audits.google.audits.glob]]
1450 who = "George Burgess IV <gbiv@google.com>"
1451 criteria = "safe-to-deploy"
1453 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1455 [[audits.google.audits.h2]]
1457 criteria = "safe-to-run"
1459 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1461 [[audits.google.audits.http]]
1463 criteria = "safe-to-run"
1465 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1467 [[audits.google.audits.http-body]]
1469 criteria = "safe-to-run"
1471 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1473 [[audits.google.audits.httpdate]]
1475 criteria = "safe-to-run"
1477 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1479 [[audits.google.audits.hyper]]
1481 criteria = "safe-to-run"
1483 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1485 [[audits.google.audits.pin-project]]
1487 criteria = "safe-to-run"
1489 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1491 [[audits.google.audits.pin-project-internal]]
1493 criteria = "safe-to-run"
1495 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1497 [[audits.google.audits.pin-project-lite]]
1498 who = "David Koloski <dkoloski@google.com>"
1499 criteria = "safe-to-deploy"
1501 notes = "Reviewed on https://fxrev.dev/824504"
1502 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1504 [[audits.google.audits.scoped-tls]]
1505 who = "George Burgess IV <gbiv@google.com>"
1506 criteria = "safe-to-run"
1508 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1510 [[audits.google.audits.serde_urlencoded]]
1512 criteria = "safe-to-run"
1514 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1516 [[audits.google.audits.tokio]]
1517 who = "Vovo Yang <vovoy@google.com>"
1518 criteria = "safe-to-run"
1520 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1522 [[audits.google.audits.tokio-stream]]
1523 who = "David Koloski <dkoloski@google.com>"
1524 criteria = "safe-to-deploy"
1526 notes = "Reviewed on https://fxrev.dev/804724"
1527 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
1529 [[audits.google.audits.tower-service]]
1531 criteria = "safe-to-run"
1533 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1535 [[audits.google.audits.tracing]]
1537 criteria = "safe-to-run"
1539 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1541 [[audits.google.audits.tracing-attributes]]
1543 criteria = "safe-to-run"
1545 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1547 [[audits.google.audits.tracing-core]]
1549 criteria = "safe-to-run"
1551 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1553 [[audits.google.audits.try-lock]]
1555 criteria = "safe-to-run"
1557 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1559 [[audits.google.audits.version_check]]
1560 who = "George Burgess IV <gbiv@google.com>"
1561 criteria = "safe-to-deploy"
1563 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1565 [[audits.google.audits.want]]
1567 criteria = "safe-to-run"
1569 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
1571 [[audits.isrg.wildcard-audits.prio]]
1572 who = "David Cook <dcook@divviup.org>"
1573 criteria = "safe-to-deploy"
1574 user-id = 101233 # le-automaton
1575 start = "2020-09-28"
1578 [[audits.isrg.wildcard-audits.prio]]
1579 who = "David Cook <dcook@divviup.org>"
1580 criteria = "safe-to-deploy"
1581 user-id = 213776 # divviup-github-automation
1582 start = "2020-09-28"
1585 [[audits.isrg.audits.base64]]
1586 who = "Tim Geoghegan <timg@letsencrypt.org>"
1587 criteria = "safe-to-deploy"
1588 delta = "0.21.0 -> 0.21.1"
1590 [[audits.isrg.audits.base64]]
1591 who = "Brandon Pitman <bran@bran.land>"
1592 criteria = "safe-to-deploy"
1593 delta = "0.21.1 -> 0.21.2"
1595 [[audits.isrg.audits.base64]]
1596 who = "David Cook <dcook@divviup.org>"
1597 criteria = "safe-to-deploy"
1598 delta = "0.21.2 -> 0.21.3"
1600 [[audits.isrg.audits.block-buffer]]
1601 who = "David Cook <dcook@divviup.org>"
1602 criteria = "safe-to-deploy"
1605 [[audits.isrg.audits.getrandom]]
1606 who = "Tim Geoghegan <timg@letsencrypt.org>"
1607 criteria = "safe-to-deploy"
1608 delta = "0.2.9 -> 0.2.10"
1609 notes = "These changes include some new `unsafe` code for the `emscripten` and `psvita` targets, but all it does is call `libc::getentropy`."
1611 [[audits.isrg.audits.keccak]]
1612 who = "David Cook <dcook@divviup.org>"
1613 criteria = "safe-to-deploy"
1616 [[audits.isrg.audits.keccak]]
1617 who = "Brandon Pitman <bran@bran.land>"
1618 criteria = "safe-to-deploy"
1619 delta = "0.1.3 -> 0.1.4"
1621 [[audits.isrg.audits.once_cell]]
1622 who = "Brandon Pitman <bran@bran.land>"
1623 criteria = "safe-to-deploy"
1624 delta = "1.17.1 -> 1.17.2"
1626 [[audits.isrg.audits.once_cell]]
1627 who = "David Cook <dcook@divviup.org>"
1628 criteria = "safe-to-deploy"
1629 delta = "1.17.2 -> 1.18.0"
1631 [[audits.isrg.audits.once_cell]]
1632 who = "Brandon Pitman <bran@bran.land>"
1633 criteria = "safe-to-deploy"
1634 delta = "1.18.0 -> 1.19.0"
1636 [[audits.isrg.audits.rand_chacha]]
1637 who = "David Cook <dcook@divviup.org>"
1638 criteria = "safe-to-deploy"
1641 [[audits.isrg.audits.rand_core]]
1642 who = "David Cook <dcook@divviup.org>"
1643 criteria = "safe-to-deploy"
1646 [[audits.isrg.audits.rayon-core]]
1647 who = "Brandon Pitman <bran@bran.land>"
1648 criteria = "safe-to-deploy"
1649 delta = "1.10.2 -> 1.11.0"
1651 [[audits.isrg.audits.rayon-core]]
1652 who = "David Cook <dcook@divviup.org>"
1653 criteria = "safe-to-deploy"
1654 delta = "1.11.0 -> 1.12.0"
1656 [[audits.isrg.audits.sha2]]
1657 who = "David Cook <dcook@divviup.org>"
1658 criteria = "safe-to-deploy"
1661 [[audits.isrg.audits.sha3]]
1662 who = "David Cook <dcook@divviup.org>"
1663 criteria = "safe-to-deploy"
1666 [[audits.isrg.audits.sha3]]
1667 who = "Brandon Pitman <bran@bran.land>"
1668 criteria = "safe-to-deploy"
1669 delta = "0.10.7 -> 0.10.8"
1671 [[audits.mozilla.wildcard-audits.uniffi]]
1672 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1673 criteria = "safe-to-deploy"
1674 user-id = 111105 # Mark Hammond (mhammond)
1675 start = "2021-11-22"
1677 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1679 [[audits.mozilla.wildcard-audits.uniffi_bindgen]]
1680 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1681 criteria = "safe-to-deploy"
1682 user-id = 111105 # Mark Hammond (mhammond)
1683 start = "2021-11-22"
1685 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1687 [[audits.mozilla.wildcard-audits.uniffi_build]]
1688 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1689 criteria = "safe-to-deploy"
1690 user-id = 111105 # Mark Hammond (mhammond)
1691 start = "2021-11-22"
1693 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1695 [[audits.mozilla.wildcard-audits.uniffi_checksum_derive]]
1696 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1697 criteria = "safe-to-deploy"
1698 user-id = 111105 # Mark Hammond (mhammond)
1699 start = "2023-11-20"
1701 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1703 [[audits.mozilla.wildcard-audits.uniffi_core]]
1704 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1705 criteria = "safe-to-deploy"
1706 user-id = 111105 # Mark Hammond (mhammond)
1707 start = "2023-11-20"
1709 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1711 [[audits.mozilla.wildcard-audits.uniffi_macros]]
1712 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1713 criteria = "safe-to-deploy"
1714 user-id = 111105 # Mark Hammond (mhammond)
1715 start = "2021-11-22"
1717 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1719 [[audits.mozilla.wildcard-audits.uniffi_meta]]
1720 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1721 criteria = "safe-to-deploy"
1722 user-id = 111105 # Mark Hammond (mhammond)
1723 start = "2023-11-20"
1725 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1727 [[audits.mozilla.wildcard-audits.uniffi_testing]]
1728 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1729 criteria = "safe-to-deploy"
1730 user-id = 111105 # Mark Hammond (mhammond)
1731 start = "2023-11-20"
1733 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1735 [[audits.mozilla.wildcard-audits.uniffi_udl]]
1736 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1737 criteria = "safe-to-deploy"
1738 user-id = 111105 # Mark Hammond (mhammond)
1739 start = "2023-11-20"
1741 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1743 [[audits.mozilla.wildcard-audits.zeitstempel]]
1744 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1745 criteria = "safe-to-deploy"
1746 user-id = 48 # Jan-Erik Rediger (badboy)
1747 start = "2021-03-03"
1749 notes = "Maintained by me"
1750 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1752 [[audits.mozilla.audits.askama]]
1753 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1754 criteria = "safe-to-deploy"
1755 delta = "0.11.1 -> 0.12.0"
1756 notes = "No new unsafe usage, mostly dependency updates and smaller API changes"
1757 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1759 [[audits.mozilla.audits.askama_derive]]
1760 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1761 criteria = "safe-to-deploy"
1762 delta = "0.11.2 -> 0.12.1"
1763 notes = "Dependency updates, a new toml dependency and some API changes. No unsafe use."
1764 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1766 [[audits.mozilla.audits.basic-toml]]
1767 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1768 criteria = "safe-to-deploy"
1770 notes = "TOML parser, forked from toml 0.5"
1771 aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
1773 [[audits.mozilla.audits.either]]
1774 who = "Nika Layzell <nika@thelayzells.com>"
1775 criteria = "safe-to-deploy"
1778 Straightforward crate providing the Either enum and trait implementations with
1781 aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
1783 [[audits.mozilla.audits.lazy_static]]
1784 who = "Nika Layzell <nika@thelayzells.com>"
1785 criteria = "safe-to-deploy"
1787 notes = "I have read over the macros, and audited the unsafe code."
1788 aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"