supply-chain/audits.toml

   1
   2 # cargo-vet audits file
   3
   4 [[wildcard-audits.audio_thread_priority]]
   5 who = "Paul Adenot <paul@paul.cx>"
   6 criteria = "safe-to-deploy"
   7 user-id = 1258 # Paul Adenot (padenot)
   8 start = "2019-05-09"
   9 end = "2024-04-24"
  10 notes = """
  11 I've written most of this crate, the rest has been either written and in any
  12 case has been reviewed by Mozilla developers.
  13 """
  14
  15 [[wildcard-audits.authenticator]]
  16 who = "John M. Schanck <jschanck@mozilla.com>"
  17 criteria = "safe-to-deploy"
  18 user-id = 175410 # John Schanck (jschanck)
  19 start = "2022-11-15"
  20 end = "2024-04-26"
  21 notes = "Maintained by the CryptoEng team at Mozilla."
  22
  23 [[wildcard-audits.bhttp]]
  24 who = "Martin Thomson <mt@lowentropy.net>"
  25 criteria = "safe-to-deploy"
  26 user-id = 128763 # Martin Thomson (martinthomson)
  27 start = "2022-08-04"
  28 end = "2024-03-09"
  29 notes = "Though the code is safe to run and deploy, the code for processing HTTP/1.1 messages (the `read-http` feature, specifically) is not suited for deployment in real applications, either clients or servers.  Some features necessary for live deployment are not implemented, such as the proper handling of some types of response (e.g., a response to a HEAD request).  Software that processes HTTP/1.1 messages requires a large number of compatibility tweaks if it is to be deployed interoperably.  This feature only exists to support basic validation tools and is unlikely to be widely compatible."
  30
  31 [[wildcard-audits.cexpr]]
  32 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
  33 criteria = "safe-to-deploy"
  34 user-id = 3788 # Emilio Cobos Álvarez (emilio)
  35 start = "2021-06-21"
  36 end = "2024-04-21"
  37 notes = "No unsafe code, rather straight-forward parser."
  38
  39 [[wildcard-audits.cocoa]]
  40 who = "Bobby Holley <bobbyholley@gmail.com>"
  41 criteria = "safe-to-deploy"
  42 user-id = 2396 # Josh Matthews (jdm)
  43 start = "2019-07-23"
  44 end = "2023-05-04"
  45 renew = false
  46 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
  47
  48 [[wildcard-audits.cocoa]]
  49 who = "Bobby Holley <bobbyholley@gmail.com>"
  50 criteria = "safe-to-deploy"
  51 user-id = 5946 # Jeff Muizelaar (jrmuizel)
  52 start = "2022-11-01"
  53 end = "2023-05-04"
  54 renew = false
  55 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
  56
  57 [[wildcard-audits.cocoa-foundation]]
  58 who = "Bobby Holley <bobbyholley@gmail.com>"
  59 criteria = "safe-to-deploy"
  60 user-id = 5946 # Jeff Muizelaar (jrmuizel)
  61 start = "2023-03-16"
  62 end = "2023-05-04"
  63 renew = false
  64 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
  65
  66 [[wildcard-audits.cocoa-foundation]]
  67 who = "Bobby Holley <bobbyholley@gmail.com>"
  68 criteria = "safe-to-deploy"
  69 user-id = 2396 # Josh Matthews (jdm)
  70 start = "2020-07-20"
  71 end = "2023-05-04"
  72 renew = false
  73 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
  74
  75 [[wildcard-audits.core-foundation]]
  76 who = "Bobby Holley <bobbyholley@gmail.com>"
  77 criteria = "safe-to-deploy"
  78 user-id = 2396 # Josh Matthews (jdm)
  79 start = "2019-11-12"
  80 end = "2023-05-04"
  81 renew = false
  82 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
  83
  84 [[wildcard-audits.core-foundation]]
  85 who = "Bobby Holley <bobbyholley@gmail.com>"
  86 criteria = "safe-to-deploy"
  87 user-id = 5946 # Jeff Muizelaar (jrmuizel)
  88 start = "2019-03-29"
  89 end = "2023-05-04"
  90 renew = false
  91 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
  92
  93 [[wildcard-audits.core-foundation-sys]]
  94 who = "Bobby Holley <bobbyholley@gmail.com>"
  95 criteria = "safe-to-deploy"
  96 user-id = 2396 # Josh Matthews (jdm)
  97 start = "2019-11-12"
  98 end = "2023-05-04"
  99 renew = false
 100 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 101
 102 [[wildcard-audits.core-foundation-sys]]
 103 who = "Bobby Holley <bobbyholley@gmail.com>"
 104 criteria = "safe-to-deploy"
 105 user-id = 5946 # Jeff Muizelaar (jrmuizel)
 106 start = "2020-10-14"
 107 end = "2023-05-04"
 108 renew = false
 109 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 110
 111 [[wildcard-audits.core-graphics]]
 112 who = "Bobby Holley <bobbyholley@gmail.com>"
 113 criteria = "safe-to-deploy"
 114 user-id = 2396 # Josh Matthews (jdm)
 115 start = "2019-10-28"
 116 end = "2023-05-04"
 117 renew = false
 118 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 119
 120 [[wildcard-audits.core-graphics]]
 121 who = "Bobby Holley <bobbyholley@gmail.com>"
 122 criteria = "safe-to-deploy"
 123 user-id = 5946 # Jeff Muizelaar (jrmuizel)
 124 start = "2020-12-08"
 125 end = "2023-05-04"
 126 renew = false
 127 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 128
 129 [[wildcard-audits.core-graphics-types]]
 130 who = "Bobby Holley <bobbyholley@gmail.com>"
 131 criteria = "safe-to-deploy"
 132 user-id = 2396 # Josh Matthews (jdm)
 133 start = "2020-07-20"
 134 end = "2023-05-04"
 135 renew = false
 136 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 137
 138 [[wildcard-audits.core-text]]
 139 who = "Bobby Holley <bobbyholley@gmail.com>"
 140 criteria = "safe-to-deploy"
 141 user-id = 2396 # Josh Matthews (jdm)
 142 start = "2019-03-29"
 143 end = "2023-05-04"
 144 renew = false
 145 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 146
 147 [[wildcard-audits.core-text]]
 148 who = "Bobby Holley <bobbyholley@gmail.com>"
 149 criteria = "safe-to-deploy"
 150 user-id = 5946 # Jeff Muizelaar (jrmuizel)
 151 start = "2021-02-14"
 152 end = "2023-05-04"
 153 renew = false
 154 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 155
 156 [[wildcard-audits.dogear]]
 157 who = "Bobby Holley <bobbyholley@gmail.com>"
 158 criteria = "safe-to-deploy"
 159 user-id = 27901 # Lina Butler (linabutler)
 160 start = "2019-03-04"
 161 end = "2024-05-05"
 162 notes = "Lina developed this crate as Mozilla staff."
 163
 164 [[wildcard-audits.encoding_rs]]
 165 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
 166 criteria = "safe-to-deploy"
 167 user-id = 4484 # Henri Sivonen (hsivonen)
 168 start = "2019-02-26"
 169 end = "2024-08-28"
 170 notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
 171
 172 [[wildcard-audits.etagere]]
 173 who = "Nicolas Silva <nical@fastmail.com>"
 174 criteria = "safe-to-deploy"
 175 user-id = 1281 # Nicolas Silva (nical)
 176 start = "2020-11-12"
 177 end = "2024-04-25"
 178 notes = "I am the author of this crate."
 179
 180 [[wildcard-audits.euclid]]
 181 who = "Nicolas Silva <nical@fastmail.com>"
 182 criteria = "safe-to-deploy"
 183 user-id = 1281 # Nicolas Silva (nical)
 184 start = "2019-03-14"
 185 end = "2024-04-25"
 186 notes = "I wrote most of the commits in the euclid reprository and review every change that is not produced by me."
 187
 188 [[wildcard-audits.freetype]]
 189 who = "Bobby Holley <bobbyholley@gmail.com>"
 190 criteria = "safe-to-deploy"
 191 user-id = 2396 # Josh Matthews (jdm)
 192 start = "2020-02-28"
 193 end = "2023-05-04"
 194 renew = false
 195 notes = "All code written or reviewed by Mozilla staff."
 196
 197 [[wildcard-audits.gleam]]
 198 who = "Bobby Holley <bobbyholley@gmail.com>"
 199 criteria = "safe-to-deploy"
 200 user-id = 2396 # Josh Matthews (jdm)
 201 start = "2019-03-18"
 202 end = "2023-05-04"
 203 renew = false
 204 notes = "All code written or reviewed by Mozilla."
 205
 206 [[wildcard-audits.gleam]]
 207 who = "Bobby Holley <bobbyholley@gmail.com>"
 208 criteria = "safe-to-deploy"
 209 user-id = 5946 # Jeff Muizelaar (jrmuizel)
 210 start = "2023-04-21"
 211 end = "2023-05-04"
 212 renew = false
 213 notes = "All code written or reviewed by Mozilla."
 214
 215 [[wildcard-audits.gleam]]
 216 who = "Bobby Holley <bobbyholley@gmail.com>"
 217 criteria = "safe-to-deploy"
 218 user-id = 1039
 219 start = "2019-03-01"
 220 end = "2023-05-04"
 221 renew = false
 222 notes = "All code written or reviewed by Mozilla."
 223
 224 [[wildcard-audits.glean]]
 225 who = "Chris H-C <chutten@mozilla.com>"
 226 criteria = "safe-to-deploy"
 227 user-id = 48 # Jan-Erik Rediger (badboy)
 228 start = "2020-11-10"
 229 end = "2024-02-24"
 230 notes = "The Glean SDKs are maintained by the Glean Team at Mozilla."
 231
 232 [[wildcard-audits.glean-core]]
 233 who = "Chris H-C <chutten@mozilla.com>"
 234 criteria = "safe-to-deploy"
 235 user-id = 48 # Jan-Erik Rediger (badboy)
 236 start = "2019-09-24"
 237 end = "2024-02-24"
 238 notes = "The Glean SDKs are maintained by the Glean Team at Mozilla."
 239
 240 [[wildcard-audits.glslopt]]
 241 who = "Jamie Nicol <jnicol@mozilla.com>"
 242 criteria = "safe-to-deploy"
 243 user-id = 84794 # Jamie Nicol (jamienicol)
 244 start = "2020-04-07"
 245 end = "2024-04-25"
 246
 247 [[wildcard-audits.io-surface]]
 248 who = "Bobby Holley <bobbyholley@gmail.com>"
 249 criteria = "safe-to-deploy"
 250 user-id = 2396 # Josh Matthews (jdm)
 251 start = "2019-07-23"
 252 end = "2023-05-04"
 253 renew = false
 254 notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
 255
 256 [[wildcard-audits.marionette]]
 257 who = "Henrik Skupin <mail@hskupin.info>"
 258 criteria = "safe-to-run"
 259 user-id = 22262
 260 start = "2020-11-03"
 261 end = "2024-03-31"
 262 notes = "Maintained by the DevTools team at Mozilla and has no unsafe code."
 263
 264 [[wildcard-audits.mozdevice]]
 265 who = "Henrik Skupin <mail@hskupin.info>"
 266 criteria = "safe-to-run"
 267 user-id = 22262
 268 start = "2020-11-03"
 269 end = "2024-03-31"
 270 notes = "Maintained by the DevTools team at Mozilla and has no unsafe code."
 271
 272 [[wildcard-audits.mozprofile]]
 273 who = "Henrik Skupin <mail@hskupin.info>"
 274 criteria = "safe-to-deploy"
 275 user-id = 22262
 276 start = "2020-11-03"
 277 end = "2024-03-31"
 278 notes = "Maintained by the DevTools team at Mozilla and has no unsafe code."
 279
 280 [[wildcard-audits.mozrunner]]
 281 who = "Henrik Skupin <mail@hskupin.info>"
 282 criteria = "safe-to-deploy"
 283 user-id = 22262
 284 start = "2020-11-03"
 285 end = "2024-03-31"
 286 notes = "Maintained by the DevTools team at Mozilla and has no unsafe code."
 287
 288 [[wildcard-audits.mozversion]]
 289 who = "Henrik Skupin <mail@hskupin.info>"
 290 criteria = "safe-to-run"
 291 user-id = 22262
 292 start = "2020-11-03"
 293 end = "2024-03-31"
 294 notes = "Maintained by the DevTools team at Mozilla and has no unsafe code."
 295
 296 [[wildcard-audits.nss-gk-api]]
 297 who = "John M. Schanck <jschanck@mozilla.com>"
 298 criteria = "safe-to-deploy"
 299 user-id = 175410 # John Schanck (jschanck)
 300 start = "2022-11-14"
 301 end = "2024-06-20"
 302 notes = "Maintained by the CryptoEng team at Mozilla."
 303
 304 [[wildcard-audits.ohttp]]
 305 who = "Martin Thomson <mt@lowentropy.net>"
 306 criteria = "safe-to-deploy"
 307 user-id = 128763 # Martin Thomson (martinthomson)
 308 start = "2022-08-04"
 309 end = "2024-03-09"
 310 notes = "This code contains two cryptographic back ends.  No unsafe code is contained if the Rust `hpke` crate is used (the `rust-hpke` feature).  Using NSS (the `nss` feature) involves extensive use of bindings to the native code provided by NSS.  This interface uses wrappers that attempt to add safety to a fundamentally very dangerous library, but those wrappers have only been validated for use following the needs of this crate."
 311
 312 [[wildcard-audits.qcms]]
 313 who = "Jeff Muizelaar <jmuizelaar@mozilla.com>"
 314 criteria = "safe-to-deploy"
 315 user-id = 5946 # Jeff Muizelaar (jrmuizel)
 316 start = "2020-11-05"
 317 end = "2025-01-09"
 318 notes = "Maintained by the Graphics team at Mozilla in mozilla-central."
 319
 320 [[wildcard-audits.rust_cascade]]
 321 who = "Dana Keeler <dkeeler@mozilla.com>"
 322 criteria = "safe-to-deploy"
 323 user-id = 57462 # Dana Keeler (mozkeeler)
 324 start = "2019-11-15"
 325 end = "2024-04-24"
 326 notes = "Written and maintained by the security engineering team at Mozilla."
 327
 328 [[wildcard-audits.unicode-normalization]]
 329 who = "Manish Goregaokar <manishsmail@gmail.com>"
 330 criteria = "safe-to-deploy"
 331 user-id = 1139 # Manish Goregaokar (Manishearth)
 332 start = "2019-11-06"
 333 end = "2024-05-03"
 334 notes = "All code written or reviewed by Manish"
 335
 336 [[wildcard-audits.unicode-segmentation]]
 337 who = "Manish Goregaokar <manishsmail@gmail.com>"
 338 criteria = "safe-to-deploy"
 339 user-id = 1139 # Manish Goregaokar (Manishearth)
 340 start = "2019-05-15"
 341 end = "2024-05-03"
 342 notes = "All code written or reviewed by Manish"
 343
 344 [[wildcard-audits.unicode-width]]
 345 who = "Manish Goregaokar <manishsmail@gmail.com>"
 346 criteria = "safe-to-deploy"
 347 user-id = 1139 # Manish Goregaokar (Manishearth)
 348 start = "2019-12-05"
 349 end = "2024-05-03"
 350 notes = "All code written or reviewed by Manish"
 351
 352 [[wildcard-audits.unicode-xid]]
 353 who = "Manish Goregaokar <manishsmail@gmail.com>"
 354 criteria = "safe-to-deploy"
 355 user-id = 1139 # Manish Goregaokar (Manishearth)
 356 start = "2019-07-25"
 357 end = "2024-05-03"
 358 notes = "All code written or reviewed by Manish"
 359
 360 [[wildcard-audits.uniffi]]
 361 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 362 criteria = "safe-to-deploy"
 363 user-id = 48 # Jan-Erik Rediger (badboy)
 364 start = "2022-05-05"
 365 end = "2024-06-21"
 366 notes = "Maintained by the Glean and Application Services teams"
 367
 368 [[wildcard-audits.uniffi]]
 369 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 370 criteria = "safe-to-deploy"
 371 user-id = 127697 # bendk
 372 start = "2021-10-27"
 373 end = "2024-12-11"
 374 notes = "Maintained by the Glean and Application Services teams"
 375
 376 [[wildcard-audits.uniffi_bindgen]]
 377 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 378 criteria = "safe-to-deploy"
 379 user-id = 48 # Jan-Erik Rediger (badboy)
 380 start = "2022-05-05"
 381 end = "2024-06-21"
 382 notes = "Maintained by the Glean and Application Services teams"
 383
 384 [[wildcard-audits.uniffi_bindgen]]
 385 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 386 criteria = "safe-to-deploy"
 387 user-id = 127697 # bendk
 388 start = "2021-10-27"
 389 end = "2024-12-11"
 390 notes = "Maintained by the Glean and Application Services teams"
 391
 392 [[wildcard-audits.uniffi_build]]
 393 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 394 criteria = "safe-to-deploy"
 395 user-id = 48 # Jan-Erik Rediger (badboy)
 396 start = "2022-05-05"
 397 end = "2024-06-21"
 398 notes = "Maintained by the Glean and Application Services teams"
 399
 400 [[wildcard-audits.uniffi_build]]
 401 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 402 criteria = "safe-to-deploy"
 403 user-id = 127697 # bendk
 404 start = "2021-10-27"
 405 end = "2024-12-11"
 406 notes = "Maintained by the Glean and Application Services teams"
 407
 408 [[wildcard-audits.uniffi_checksum_derive]]
 409 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 410 criteria = "safe-to-deploy"
 411 user-id = 48 # Jan-Erik Rediger (badboy)
 412 start = "2022-12-16"
 413 end = "2024-06-21"
 414 notes = "Maintained by the Glean and Application Services teams"
 415
 416 [[wildcard-audits.uniffi_checksum_derive]]
 417 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 418 criteria = "safe-to-deploy"
 419 user-id = 127697 # bendk
 420 start = "2023-01-27"
 421 end = "2024-12-11"
 422 notes = "Maintained by the Glean and Application Services teams"
 423
 424 [[wildcard-audits.uniffi_core]]
 425 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 426 criteria = "safe-to-deploy"
 427 user-id = 48 # Jan-Erik Rediger (badboy)
 428 start = "2023-06-21"
 429 end = "2024-06-21"
 430 notes = "Maintained by the Glean and Application Services teams"
 431
 432 [[wildcard-audits.uniffi_core]]
 433 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 434 criteria = "safe-to-deploy"
 435 user-id = 127697 # bendk
 436 start = "2023-01-27"
 437 end = "2024-12-11"
 438 notes = "Maintained by the Glean and Application Services teams"
 439
 440 [[wildcard-audits.uniffi_macros]]
 441 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 442 criteria = "safe-to-deploy"
 443 user-id = 48 # Jan-Erik Rediger (badboy)
 444 start = "2022-05-05"
 445 end = "2024-06-21"
 446 notes = "Maintained by the Glean and Application Services teams"
 447
 448 [[wildcard-audits.uniffi_macros]]
 449 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 450 criteria = "safe-to-deploy"
 451 user-id = 127697 # bendk
 452 start = "2021-10-27"
 453 end = "2024-12-11"
 454 notes = "Maintained by the Glean and Application Services teams"
 455
 456 [[wildcard-audits.uniffi_meta]]
 457 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 458 criteria = "safe-to-deploy"
 459 user-id = 48 # Jan-Erik Rediger (badboy)
 460 start = "2022-08-31"
 461 end = "2024-06-21"
 462 notes = "Maintained by the Glean and Application Services teams"
 463
 464 [[wildcard-audits.uniffi_meta]]
 465 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 466 criteria = "safe-to-deploy"
 467 user-id = 127697 # bendk
 468 start = "2022-09-13"
 469 end = "2024-12-11"
 470 notes = "Maintained by the Glean and Application Services teams"
 471
 472 [[wildcard-audits.uniffi_testing]]
 473 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 474 criteria = "safe-to-deploy"
 475 user-id = 48 # Jan-Erik Rediger (badboy)
 476 start = "2022-12-16"
 477 end = "2024-06-21"
 478 notes = "Maintained by the Glean and Application Services teams"
 479
 480 [[wildcard-audits.uniffi_testing]]
 481 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 482 criteria = "safe-to-deploy"
 483 user-id = 127697 # bendk
 484 start = "2023-01-27"
 485 end = "2024-12-11"
 486 notes = "Maintained by the Glean and Application Services teams"
 487
 488 [[wildcard-audits.uniffi_udl]]
 489 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
 490 criteria = "safe-to-deploy"
 491 user-id = 127697 # bendk
 492 start = "2023-10-18"
 493 end = "2024-12-11"
 494 notes = "Maintained by the Glean and Application Services teams"
 495
 496 [[wildcard-audits.utf8_iter]]
 497 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
 498 criteria = "safe-to-deploy"
 499 user-id = 4484 # Henri Sivonen (hsivonen)
 500 start = "2022-04-19"
 501 end = "2024-06-16"
 502 notes = "Maintained by Henri Sivonen who works at Mozilla."
 503
 504 [[wildcard-audits.webdriver]]
 505 who = "Henrik Skupin <mail@hskupin.info>"
 506 criteria = "safe-to-deploy"
 507 user-id = 22262
 508 start = "2020-11-03"
 509 end = "2024-03-31"
 510 notes = "Maintained by the DevTools team at Mozilla and has no unsafe code."
 511
 512 [[audits.aa-stroke]]
 513 who = "Lee Salzman <lsalzman@mozilla.com>"
 514 criteria = "safe-to-deploy"
 515 version = "0.1.0"
 516 notes = "Written and maintained by Gfx team at Mozilla."
 517
 518 [[audits.aho-corasick]]
 519 who = "Mike Hommey <mh+mozilla@glandium.org>"
 520 criteria = "safe-to-deploy"
 521 delta = "0.7.18 -> 0.7.20"
 522
 523 [[audits.alsa]]
 524 who = "Mike Hommey <mh+mozilla@glandium.org>"
 525 criteria = "safe-to-deploy"
 526 delta = "0.4.3 -> 0.7.0"
 527
 528 [[audits.android_logger]]
 529 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 530 criteria = "safe-to-deploy"
 531 version = "0.11.0"
 532 notes = "Small crate, wrapping Android log functionality, reviewed by janerik"
 533
 534 [[audits.android_logger]]
 535 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 536 criteria = "safe-to-deploy"
 537 delta = "0.11.0 -> 0.11.1"
 538 notes = "Small crate, wrapping Android log functionality, now switched to properly using MaybeUninit"
 539
 540 [[audits.android_logger]]
 541 who = "Mike Hommey <mh+mozilla@glandium.org>"
 542 criteria = "safe-to-deploy"
 543 delta = "0.11.1 -> 0.11.3"
 544
 545 [[audits.android_logger]]
 546 who = "Chris H-C <chutten@mozilla.com>"
 547 criteria = "safe-to-deploy"
 548 delta = "0.11.3 -> 0.12.0"
 549 notes = "Small wrapper crate. This update fixes log level filtering."
 550
 551 [[audits.android_system_properties]]
 552 who = "Nicolas Silva <nical@fastmail.com>"
 553 criteria = "safe-to-deploy"
 554 version = "0.1.2"
 555 notes = "I wrote this crate, reviewed by jimb. It is mostly a Rust port of some C++ code we already ship."
 556
 557 [[audits.android_system_properties]]
 558 who = "Mike Hommey <mh+mozilla@glandium.org>"
 559 criteria = "safe-to-deploy"
 560 delta = "0.1.2 -> 0.1.4"
 561
 562 [[audits.android_system_properties]]
 563 who = "Mike Hommey <mh+mozilla@glandium.org>"
 564 criteria = "safe-to-deploy"
 565 delta = "0.1.4 -> 0.1.5"
 566
 567 [[audits.anyhow]]
 568 who = "Mike Hommey <mh+mozilla@glandium.org>"
 569 criteria = "safe-to-deploy"
 570 delta = "1.0.57 -> 1.0.61"
 571
 572 [[audits.anyhow]]
 573 who = "Bobby Holley <bobbyholley@gmail.com>"
 574 criteria = "safe-to-deploy"
 575 delta = "1.0.58 -> 1.0.57"
 576 notes = "No functional differences, just CI config and docs."
 577
 578 [[audits.anyhow]]
 579 who = "Mike Hommey <mh+mozilla@glandium.org>"
 580 criteria = "safe-to-deploy"
 581 delta = "1.0.61 -> 1.0.62"
 582
 583 [[audits.anyhow]]
 584 who = "Mike Hommey <mh+mozilla@glandium.org>"
 585 criteria = "safe-to-deploy"
 586 delta = "1.0.62 -> 1.0.68"
 587
 588 [[audits.anyhow]]
 589 who = "Mike Hommey <mh+mozilla@glandium.org>"
 590 criteria = "safe-to-deploy"
 591 delta = "1.0.68 -> 1.0.69"
 592
 593 [[audits.app_units]]
 594 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
 595 criteria = "safe-to-deploy"
 596 version = "0.7.1"
 597 notes = """
 598 I'm pretty familiar with this crate. It provides a fixed-point numeric type.
 599 The code is pretty straight-forward, there's no unsafe code at all.
 600 """
 601
 602 [[audits.app_units]]
 603 who = "Nicolas Silva <nical@fastmail.com>"
 604 criteria = "safe-to-deploy"
 605 version = "0.7.3"
 606
 607 [[audits.app_units]]
 608 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
 609 criteria = "safe-to-deploy"
 610 delta = "0.7.1 -> 0.7.2"
 611 notes = "Adding repr(transparent) plus a couple minor clean-ups, no functional changes from 0.7.1."
 612
 613 [[audits.arbitrary]]
 614 who = "Mike Hommey <mh+mozilla@glandium.org>"
 615 criteria = "safe-to-run"
 616 delta = "1.1.0 -> 1.1.1"
 617
 618 [[audits.arbitrary]]
 619 who = "Mike Hommey <mh+mozilla@glandium.org>"
 620 criteria = "safe-to-run"
 621 delta = "1.1.1 -> 1.1.3"
 622
 623 [[audits.arbitrary]]
 624 who = "Mike Hommey <mh+mozilla@glandium.org>"
 625 criteria = "safe-to-run"
 626 delta = "1.1.3 -> 1.2.0"
 627
 628 [[audits.arbitrary]]
 629 who = "Mike Hommey <mh+mozilla@glandium.org>"
 630 criteria = "safe-to-run"
 631 delta = "1.2.0 -> 1.2.3"
 632
 633 [[audits.ash]]
 634 who = "Jim Blandy <jimb@red-bean.com>"
 635 criteria = "safe-to-deploy"
 636 delta = "0.37.0+1.3.209 -> 0.37.1+1.3.235"
 637 notes = """
 638 Nicolas Silva, Jim Blandy, and Teodor Tanasoaia audited ash master
 639 branch commits from e43e9c0c to 6bd82768 inclusive.
 640 """
 641
 642 [[audits.ash]]
 643 who = "Nicolas Silva <nical@fastmail.com>"
 644 criteria = "safe-to-deploy"
 645 delta = "0.37.1+1.3.235 -> 0.37.2+1.3.238"
 646
 647 [[audits.ash]]
 648 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
 649 criteria = "safe-to-deploy"
 650 delta = "0.37.2+1.3.238 -> 0.37.3+1.3.251"
 651
 652 [[audits.ashmem]]
 653 who = "Matthew Gregan <kinetik@flim.org>"
 654 criteria = "safe-to-deploy"
 655 version = "0.1.2"
 656 notes = """
 657 Small unsafe wrapper around Android 8.0's ASharedMemory native API that falls
 658 back to older private ioctl-based API at runtime on earlier OS releases.  The
 659 shim code is small and doesn't inspect the API arguments, so is unlikely to
 660 expose any safety issues beyond those presented by the native OS API.
 661 """
 662
 663 [[audits.askama]]
 664 who = "Bobby Holley <bobbyholley@gmail.com>"
 665 criteria = "safe-to-deploy"
 666 version = "0.11.1"
 667 notes = """
 668 Just contains some traits and re-exports for use by a broader package of related
 669 crates. No unsafe code or ambient capability usage.
 670 """
 671
 672 [[audits.async-task]]
 673 who = "Nika Layzell <nika@thelayzells.com>"
 674 criteria = "safe-to-deploy"
 675 delta = "4.0.3 -> 4.0.3@git:f6488e35beccb26eb6e85847b02aa78a42cd3d0e"
 676 notes = "Recorded by bholley, confirmed over slack."
 677
 678 [[audits.async-task]]
 679 who = "Nika Layzell <nika@thelayzells.com>"
 680 criteria = "safe-to-deploy"
 681 delta = "4.0.3 -> 4.3.0"
 682 notes = "Main addition is the new FallibleTask type, which I implemented. No risky unsafe code changes."
 683
 684 [[audits.async-trait]]
 685 who = "Mike Hommey <mh+mozilla@glandium.org>"
 686 criteria = "safe-to-deploy"
 687 delta = "0.1.56 -> 0.1.57"
 688
 689 [[audits.async-trait]]
 690 who = "Mike Hommey <mh+mozilla@glandium.org>"
 691 criteria = "safe-to-deploy"
 692 delta = "0.1.57 -> 0.1.60"
 693
 694 [[audits.async-trait]]
 695 who = "Mike Hommey <mh+mozilla@glandium.org>"
 696 criteria = "safe-to-deploy"
 697 delta = "0.1.60 -> 0.1.64"
 698
 699 [[audits.atomic_refcell]]
 700 who = "Bobby Holley <bholley@mozilla.com>"
 701 criteria = "safe-to-deploy"
 702 version = "0.1.8"
 703 notes = "I maintain this crate and have reviewed every line."
 704
 705 [[audits.atomic_refcell]]
 706 who = "Mike Hommey <mh+mozilla@glandium.org>"
 707 criteria = "safe-to-deploy"
 708 delta = "0.1.8 -> 0.1.9"
 709
 710 [[audits.audio-mixer]]
 711 who = "Chun-Min Chang <chun.m.chang@gmail.com>"
 712 criteria = "safe-to-deploy"
 713 version = "0.1.2"
 714 notes = "audio-mixer is a Mozilla-developed package."
 715
 716 [[audits.audio-mixer]]
 717 who = "Mike Hommey <mh+mozilla@glandium.org>"
 718 criteria = "safe-to-deploy"
 719 delta = "0.1.2 -> 0.1.3"
 720
 721 [[audits.authenticator]]
 722 who = "John M. Schanck <jschanck@mozilla.com>"
 723 criteria = "safe-to-deploy"
 724 version = "0.4.0-alpha.13"
 725 notes = "Maintained by the CryptoEng team at Mozilla."
 726
 727 [[audits.autocfg]]
 728 who = "Josh Stone <jistone@redhat.com>"
 729 criteria = "safe-to-deploy"
 730 version = "1.1.0"
 731 notes = "All code written or reviewed by Josh Stone."
 732
 733 [[audits.base64]]
 734 who = "Mike Hommey <mh+mozilla@glandium.org>"
 735 criteria = "safe-to-deploy"
 736 delta = "0.13.0 -> 0.13.1"
 737
 738 [[audits.bindgen]]
 739 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
 740 criteria = "safe-to-deploy"
 741 version = "0.59.2"
 742 notes = "I'm the primary author and maintainer of the crate."
 743
 744 [[audits.bindgen]]
 745 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
 746 criteria = "safe-to-deploy"
 747 delta = "0.59.2 -> 0.63.0"
 748
 749 [[audits.bindgen]]
 750 who = "Mike Hommey <mh+mozilla@glandium.org>"
 751 criteria = "safe-to-deploy"
 752 delta = "0.63.0 -> 0.64.0"
 753
 754 [[audits.bindgen]]
 755 who = "Mike Hommey <mh+mozilla@glandium.org>"
 756 criteria = "safe-to-deploy"
 757 delta = "0.64.0 -> 0.66.1"
 758
 759 [[audits.bindgen]]
 760 who = "Mike Hommey <mh+mozilla@glandium.org>"
 761 criteria = "safe-to-deploy"
 762 delta = "0.66.1 -> 0.68.1"
 763
 764 [[audits.bindgen]]
 765 who = "Andreas Pehrson <apehrson@mozilla.com>"
 766 criteria = "safe-to-deploy"
 767 delta = "0.68.1 -> 0.69.1"
 768
 769 [[audits.bindgen]]
 770 who = "Mike Hommey <mh+mozilla@glandium.org>"
 771 criteria = "safe-to-deploy"
 772 delta = "0.69.1 -> 0.69.1@git:86f3dbe846020e2ba573d6eb38d1434d0cbcbb40"
 773
 774 [[audits.bit-set]]
 775 who = "Aria Beingessner <a.beingessner@gmail.com>"
 776 criteria = "safe-to-deploy"
 777 version = "0.5.2"
 778 notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues."
 779
 780 [[audits.bit-set]]
 781 who = "Mike Hommey <mh+mozilla@glandium.org>"
 782 criteria = "safe-to-deploy"
 783 delta = "0.5.2 -> 0.5.3"
 784
 785 [[audits.bit-vec]]
 786 who = "Aria Beingessner <a.beingessner@gmail.com>"
 787 criteria = "safe-to-deploy"
 788 version = "0.6.3"
 789 notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine."
 790
 791 [[audits.bitflags]]
 792 who = "Alex Franchuk <afranchuk@mozilla.com>"
 793 criteria = "safe-to-deploy"
 794 delta = "1.3.2 -> 2.0.2"
 795 notes = "Removal of some unsafe code/methods. No changes to externals, just some refactoring (mostly internal)."
 796
 797 [[audits.bitflags]]
 798 who = "Nicolas Silva <nical@fastmail.com>"
 799 criteria = "safe-to-deploy"
 800 delta = "2.0.2 -> 2.1.0"
 801
 802 [[audits.bitflags]]
 803 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
 804 criteria = "safe-to-deploy"
 805 delta = "2.2.1 -> 2.3.2"
 806
 807 [[audits.bitflags]]
 808 who = "Mike Hommey <mh+mozilla@glandium.org>"
 809 criteria = "safe-to-deploy"
 810 delta = "2.3.3 -> 2.4.0"
 811
 812 [[audits.block-buffer]]
 813 who = "Mike Hommey <mh+mozilla@glandium.org>"
 814 criteria = "safe-to-deploy"
 815 delta = "0.10.2 -> 0.10.3"
 816
 817 [[audits.build-parallel]]
 818 who = "Jeff Muizelaar <jmuizelaar@mozilla.com>"
 819 criteria = "safe-to-deploy"
 820 version = "0.1.2"
 821
 822 [[audits.bumpalo]]
 823 who = "Bobby Holley <bobbyholley@gmail.com>"
 824 criteria = "safe-to-run"
 825 delta = "3.9.1 -> 3.10.0"
 826 notes = """
 827 Some nontrivial functional changes but certainly meets the no-malware bar of
 828 safe-to-run. If we needed safe-to-deploy for this in m-c I'd ask Nick to re-
 829 certify this version, but we don't, so this is fine for now.
 830 """
 831
 832 [[audits.bumpalo]]
 833 who = "Mike Hommey <mh+mozilla@glandium.org>"
 834 criteria = "safe-to-run"
 835 delta = "3.11.1 -> 3.12.0"
 836
 837 [[audits.bytes]]
 838 who = "Mike Hommey <mh+mozilla@glandium.org>"
 839 criteria = "safe-to-deploy"
 840 delta = "1.1.0 -> 1.2.1"
 841
 842 [[audits.bytes]]
 843 who = "Mike Hommey <mh+mozilla@glandium.org>"
 844 criteria = "safe-to-deploy"
 845 delta = "1.2.1 -> 1.3.0"
 846
 847 [[audits.bytes]]
 848 who = "Mike Hommey <mh+mozilla@glandium.org>"
 849 criteria = "safe-to-deploy"
 850 delta = "1.3.0 -> 1.4.0"
 851
 852 [[audits.camino]]
 853 who = "Mike Hommey <mh+mozilla@glandium.org>"
 854 criteria = "safe-to-deploy"
 855 delta = "1.0.9 -> 1.1.1"
 856
 857 [[audits.camino]]
 858 who = "Mike Hommey <mh+mozilla@glandium.org>"
 859 criteria = "safe-to-deploy"
 860 delta = "1.1.1 -> 1.1.2"
 861
 862 [[audits.cargo_metadata]]
 863 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
 864 criteria = "safe-to-deploy"
 865 version = "0.15.2"
 866 notes = "I reviewed the whole code base. Parser for the output of cargo-metadata, relying mostly on serde. No unsafe code used."
 867
 868 [[audits.cargo_metadata]]
 869 who = "Mike Hommey <mh+mozilla@glandium.org>"
 870 criteria = "safe-to-deploy"
 871 delta = "0.15.2 -> 0.15.3"
 872
 873 [[audits.cc]]
 874 who = "Mike Hommey <mh+mozilla@glandium.org>"
 875 criteria = "safe-to-deploy"
 876 delta = "1.0.73 -> 1.0.78"
 877
 878 [[audits.chardetng]]
 879 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
 880 criteria = "safe-to-deploy"
 881 version = "0.1.9"
 882 notes = "I, Henri Sivonen, wrote this (safe-code-only) crate for Gecko even though the crate is published via crates.io."
 883
 884 [[audits.chardetng]]
 885 who = "Bobby Holley <bobbyholley@gmail.com>"
 886 criteria = "safe-to-deploy"
 887 delta = "0.1.9 -> 0.1.9@git:3484d3e3ebdc8931493aa5df4d7ee9360a90e76b"
 888
 889 [[audits.chardetng_c]]
 890 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
 891 criteria = "safe-to-deploy"
 892 version = "0.1.2"
 893 notes = "I, Henri Sivonen, wrote this crate for Gecko even though it is published via crates.io. The buffer input assumes Rust slice constraints for the start pointer. In Gecko, this is taken care of by mozilla::Span, but the C API doesn't conform to idiomatic C constraints on this point."
 894
 895 [[audits.chardetng_c]]
 896 who = "Bobby Holley <bobbyholley@gmail.com>"
 897 criteria = "safe-to-deploy"
 898 delta = "0.1.2 -> 0.1.2@git:ed8a4c6f900a90d4dbc1d64b856e61490a1c3570"
 899
 900 [[audits.clang-sys]]
 901 who = "Mike Hommey <mh+mozilla@glandium.org>"
 902 criteria = "safe-to-deploy"
 903 delta = "1.3.3 -> 1.4.0"
 904
 905 [[audits.clang-sys]]
 906 who = "Mike Hommey <mh+mozilla@glandium.org>"
 907 criteria = "safe-to-deploy"
 908 delta = "1.4.0 -> 1.6.0"
 909
 910 [[audits.clap_lex]]
 911 who = "Mike Hommey <mh+mozilla@glandium.org>"
 912 criteria = "safe-to-deploy"
 913 delta = "0.2.0 -> 0.2.2"
 914
 915 [[audits.clap_lex]]
 916 who = "Mike Hommey <mh+mozilla@glandium.org>"
 917 criteria = "safe-to-deploy"
 918 delta = "0.2.2 -> 0.2.4"
 919
 920 [[audits.comedy]]
 921 who = "Nick Alexander <nalexander@mozilla.com>"
 922 criteria = "safe-to-deploy"
 923 version = "0.2.0"
 924 notes = """
 925 The comedy crate was written by Adam Gashlin for Mozilla's use.  The entire
 926 comedy 0.2.0 crate is full of `unsafe` code and makes many assumptions about
 927 memory and layout, but there is no particular processing of untrusted input
 928 here.
 929 """
 930
 931 [[audits.cookie]]
 932 who = "Mike Hommey <mh+mozilla@glandium.org>"
 933 criteria = "safe-to-run"
 934 delta = "0.16.0 -> 0.16.2"
 935
 936 [[audits.core-graphics]]
 937 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
 938 criteria = "safe-to-deploy"
 939 delta = "0.22.3 -> 0.23.1"
 940
 941 [[audits.core-graphics-types]]
 942 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
 943 criteria = "safe-to-deploy"
 944 delta = "0.1.1 -> 0.1.2"
 945
 946 [[audits.core-text]]
 947 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
 948 criteria = "safe-to-deploy"
 949 delta = "19.2.0 -> 20.0.0"
 950
 951 [[audits.core-text]]
 952 who = "Jonathan Kew <jfkthame@gmail.com>"
 953 criteria = "safe-to-deploy"
 954 delta = "20.0.0 -> 20.1.0"
 955 notes = """
 956 The bulk of the 20.0.0 -> 20.1.0 changes were purely cosmetic clippy and rustfmt changes.
 957
 958 The only substantive change was the addition of wrappers to expose two additional Core Text APIs,
 959 the variants of CTFontCreateWithName and CTFontCreateWithFontDescriptor that accept a CTFontOptions
 960 parameter. These are directly parallel to the existing versions without CTFontOptions, and do not
 961 introduce any new forms of risk.
 962 """
 963
 964 [[audits.core_maths]]
 965 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
 966 criteria = "safe-to-deploy"
 967 version = "0.1.0"
 968
 969 [[audits.coreaudio-sys]]
 970 who = "Mike Hommey <mh+mozilla@glandium.org>"
 971 criteria = "safe-to-deploy"
 972 delta = "0.2.10 -> 0.2.11"
 973
 974 [[audits.coreaudio-sys]]
 975 who = "Mike Hommey <mh+mozilla@glandium.org>"
 976 criteria = "safe-to-deploy"
 977 delta = "0.2.11 -> 0.2.12"
 978
 979 [[audits.coreaudio-sys]]
 980 who = "Mike Hommey <mh+mozilla@glandium.org>"
 981 criteria = "safe-to-deploy"
 982 delta = "0.2.12 -> 0.2.13"
 983
 984 [[audits.coreaudio-sys]]
 985 who = "Andreas Pehrson <apehrson@mozilla.com>"
 986 criteria = "safe-to-deploy"
 987 delta = "0.2.13 -> 0.2.14"
 988
 989 [[audits.cose]]
 990 who = "Mathew Hodson <mathew.hodson@gmail.com>"
 991 criteria = "safe-to-deploy"
 992 delta = "0.1.4 -> 0.1.4@git:43c22248d136c8b38fe42ea709d08da6355cf04b"
 993
 994 [[audits.cpufeatures]]
 995 who = "Mike Hommey <mh+mozilla@glandium.org>"
 996 criteria = "safe-to-deploy"
 997 delta = "0.2.2 -> 0.2.4"
 998
 999 [[audits.cpufeatures]]
1000 who = "Mike Hommey <mh+mozilla@glandium.org>"
1001 criteria = "safe-to-deploy"
1002 delta = "0.2.4 -> 0.2.5"
1003
1004 [[audits.cpufeatures]]
1005 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1006 criteria = "safe-to-deploy"
1007 delta = "0.2.7 -> 0.2.8"
1008 notes = "This release contains a single fix for an issue that affected Firefox"
1009
1010 [[audits.crash-context]]
1011 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1012 criteria = "safe-to-deploy"
1013 version = "0.5.1"
1014 notes = "Mozilla employees contributed to this crate and the remaining code was fully audited"
1015
1016 [[audits.crash-context]]
1017 who = "Alex Franchuk <afranchuk@mozilla.com>"
1018 criteria = "safe-to-deploy"
1019 delta = "0.5.1 -> 0.6.0"
1020 notes = """
1021 There are few changes. The main change is the removal of `winapi` in favor of
1022 manually-generated bindings (which are minimal). The few small bugfixes are
1023 sound.
1024 """
1025
1026 [[audits.crash-context]]
1027 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1028 criteria = "safe-to-deploy"
1029 delta = "0.6.0 -> 0.6.1"
1030
1031 [[audits.crossbeam-channel]]
1032 who = "Mike Hommey <mh+mozilla@glandium.org>"
1033 criteria = "safe-to-deploy"
1034 delta = "0.5.4 -> 0.5.6"
1035
1036 [[audits.crossbeam-deque]]
1037 who = "Mike Hommey <mh+mozilla@glandium.org>"
1038 criteria = "safe-to-deploy"
1039 delta = "0.8.1 -> 0.8.2"
1040
1041 [[audits.crossbeam-epoch]]
1042 who = "Mike Hommey <mh+mozilla@glandium.org>"
1043 criteria = "safe-to-deploy"
1044 delta = "0.9.8 -> 0.9.10"
1045
1046 [[audits.crossbeam-epoch]]
1047 who = "Mike Hommey <mh+mozilla@glandium.org>"
1048 criteria = "safe-to-deploy"
1049 delta = "0.9.10 -> 0.9.13"
1050
1051 [[audits.crossbeam-epoch]]
1052 who = "Mike Hommey <mh+mozilla@glandium.org>"
1053 criteria = "safe-to-deploy"
1054 delta = "0.9.13 -> 0.9.14"
1055
1056 [[audits.crossbeam-queue]]
1057 who = "Matthew Gregan <kinetik@flim.org>"
1058 criteria = "safe-to-deploy"
1059 version = "0.3.8"
1060
1061 [[audits.crossbeam-utils]]
1062 who = "Mike Hommey <mh+mozilla@glandium.org>"
1063 criteria = "safe-to-deploy"
1064 delta = "0.8.8 -> 0.8.11"
1065
1066 [[audits.crossbeam-utils]]
1067 who = "Mike Hommey <mh+mozilla@glandium.org>"
1068 criteria = "safe-to-deploy"
1069 delta = "0.8.11 -> 0.8.14"
1070
1071 [[audits.crypto-common]]
1072 who = "Mike Hommey <mh+mozilla@glandium.org>"
1073 criteria = "safe-to-deploy"
1074 delta = "0.1.3 -> 0.1.6"
1075
1076 [[audits.cssparser]]
1077 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1078 criteria = "safe-to-deploy"
1079 version = "0.29.6"
1080 notes = """
1081 I've reviewed or authored most of the recent changes to this library, and it
1082 was developed by other mozilla folks. Unsafe code there is reasonable (utf-8
1083 casts for serialization and parsing).
1084 """
1085
1086 [[audits.cssparser]]
1087 who = "Bobby Holley <bobbyholley@gmail.com>"
1088 criteria = "safe-to-deploy"
1089 delta = "0.29.6 -> 0.31.0"
1090 notes = """
1091 All the changes in this release were authored by Mozilla staff, except the
1092 uninit_array stuff, which looks fine.
1093 """
1094
1095 [[audits.cssparser]]
1096 who = "Mike Hommey <mh+mozilla@glandium.org>"
1097 criteria = "safe-to-deploy"
1098 delta = "0.31.0 -> 0.31.2"
1099
1100 [[audits.cssparser]]
1101 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1102 criteria = "safe-to-deploy"
1103 delta = "0.31.2 -> 0.32.0"
1104 notes = "All changes were either authored or reviewed by Mozilla employees."
1105
1106 [[audits.cssparser]]
1107 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1108 criteria = "safe-to-deploy"
1109 delta = "0.32.0 -> 0.33.0"
1110 notes = """
1111 Mozilla authored. Breaking changes from 0.32 involve splitting color APIs into
1112 their own crate and removing an unused line number offset mechanism.
1113 """
1114
1115 [[audits.cssparser]]
1116 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1117 criteria = "safe-to-deploy"
1118 delta = "0.33.0 -> 0.33.0@git:aaa966d9d6ae70c4b8a62bb5e3a14c068bb7dff0"
1119 notes = "Only one minimal change exposing a previously-private enumeration."
1120
1121 [[audits.cssparser-color]]
1122 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1123 criteria = "safe-to-deploy"
1124 version = "0.1.0"
1125 notes = "This code used to live in cssparser's color module. Only moved out. Mozilla-authored."
1126
1127 [[audits.cssparser-macros]]
1128 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1129 criteria = "safe-to-deploy"
1130 version = "0.6.0"
1131 notes = """
1132 Trivial crate with a single proc macro to compute the max length of the inputs
1133 to a match expression.
1134 """
1135
1136 [[audits.cssparser-macros]]
1137 who = "Mike Hommey <mh+mozilla@glandium.org>"
1138 criteria = "safe-to-deploy"
1139 delta = "0.6.0 -> 0.6.1"
1140
1141 [[audits.cssparser-macros]]
1142 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1143 criteria = "safe-to-deploy"
1144 delta = "0.6.1 -> 0.6.1@git:aaa966d9d6ae70c4b8a62bb5e3a14c068bb7dff0"
1145 notes = "No changes from already-certified upstream, but needed because it lives in the same git repo as the cssparser crate."
1146
1147 [[audits.cstr]]
1148 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
1149 criteria = "safe-to-deploy"
1150 version = "0.2.10"
1151 notes = """
1152 I've reviewed the code of the crate thoroughly. It generates an unsafe block
1153 which is statically guaranteed to be safe. Inputs to the macro have to be
1154 static so there's no uncontrolled input whatsoever.
1155 """
1156
1157 [[audits.cstr]]
1158 who = "Mike Hommey <mh+mozilla@glandium.org>"
1159 criteria = "safe-to-deploy"
1160 delta = "0.2.10 -> 0.2.11"
1161
1162 [[audits.cubeb]]
1163 who = "Matthew Gregan <kinetik@flim.org>"
1164 criteria = "safe-to-deploy"
1165 version = "0.10.1"
1166 notes = """
1167 Mozilla-developed package.
1168 """
1169
1170 [[audits.cubeb]]
1171 who = "Matthew Gregan <kinetik@flim.org>"
1172 criteria = "safe-to-deploy"
1173 delta = "0.10.1 -> 0.10.2"
1174
1175 [[audits.cubeb]]
1176 who = "Mike Hommey <mh+mozilla@glandium.org>"
1177 criteria = "safe-to-deploy"
1178 delta = "0.10.2 -> 0.10.3"
1179
1180 [[audits.cubeb-backend]]
1181 who = "Matthew Gregan <kinetik@flim.org>"
1182 criteria = "safe-to-deploy"
1183 version = "0.10.1"
1184 notes = """
1185 Mozilla-developed package.
1186 """
1187
1188 [[audits.cubeb-backend]]
1189 who = "Matthew Gregan <kinetik@flim.org>"
1190 criteria = "safe-to-deploy"
1191 delta = "0.10.1 -> 0.10.2"
1192
1193 [[audits.cubeb-backend]]
1194 who = "Paul Adenot <paul@paul.cx>"
1195 criteria = "safe-to-deploy"
1196 delta = "0.10.2 -> 0.10.3"
1197 notes = """
1198 Mozilla-developed package.
1199 """
1200
1201 [[audits.cubeb-backend]]
1202 who = "Andreas Pehrson <apehrson@mozilla.com>"
1203 criteria = "safe-to-deploy"
1204 delta = "0.10.3 -> 0.10.7"
1205
1206 [[audits.cubeb-core]]
1207 who = "Matthew Gregan <kinetik@flim.org>"
1208 criteria = "safe-to-deploy"
1209 version = "0.10.1"
1210 notes = """
1211 Mozilla-developed package.
1212 """
1213
1214 [[audits.cubeb-core]]
1215 who = "Matthew Gregan <kinetik@flim.org>"
1216 criteria = "safe-to-deploy"
1217 delta = "0.10.1 -> 0.10.2"
1218
1219 [[audits.cubeb-core]]
1220 who = "Paul Adenot <paul@paul.cx>"
1221 criteria = "safe-to-deploy"
1222 delta = "0.10.2 -> 0.10.3"
1223 notes = """
1224 Mozilla-developed package.
1225 """
1226
1227 [[audits.cubeb-core]]
1228 who = "Mike Hommey <mh+mozilla@glandium.org>"
1229 criteria = "safe-to-deploy"
1230 delta = "0.10.3 -> 0.10.4"
1231
1232 [[audits.cubeb-core]]
1233 who = "Andreas Pehrson <apehrson@mozilla.com>"
1234 criteria = "safe-to-deploy"
1235 delta = "0.10.4 -> 0.10.7"
1236
1237 [[audits.cubeb-sys]]
1238 who = "Matthew Gregan <kinetik@flim.org>"
1239 criteria = "safe-to-deploy"
1240 version = "0.10.1"
1241 notes = """
1242 Mozilla-developed package.
1243 """
1244
1245 [[audits.cubeb-sys]]
1246 who = "Matthew Gregan <kinetik@flim.org>"
1247 criteria = "safe-to-deploy"
1248 delta = "0.10.1 -> 0.10.2"
1249
1250 [[audits.cubeb-sys]]
1251 who = "Paul Adenot <paul@paul.cx>"
1252 criteria = "safe-to-deploy"
1253 delta = "0.10.2 -> 0.10.3"
1254 notes = """
1255 Mozilla-developed package.
1256 """
1257
1258 [[audits.cubeb-sys]]
1259 who = "Andreas Pehrson <apehrson@mozilla.com>"
1260 criteria = "safe-to-deploy"
1261 delta = "0.10.3 -> 0.10.7"
1262
1263 [[audits.d3d12]]
1264 who = "Jim Blandy <jimb@red-bean.com>"
1265 criteria = "safe-to-deploy"
1266 delta = "0.4.1 -> 0.5.0"
1267 notes = "The commits between 0.4.1 and 0.5.0 were all audited by Dzmitry Malyshau or myself."
1268
1269 [[audits.d3d12]]
1270 who = "Nicolas Silva <nical@fastmail.com>"
1271 criteria = "safe-to-deploy"
1272 delta = "0.5.0 -> 0.7.0"
1273
1274 [[audits.d3d12]]
1275 who = [
1276     "Erich Gubler <egubler@mozilla.com>",
1277     "Nicolas Silva <nical@fastmail.com>",
1278     "Teodor Tanasoaia <ttanasoaia@mozilla.com>",
1279 ]
1280 criteria = "safe-to-deploy"
1281 delta = "0.7.0 -> 0.7.0@git:c6eea50b04127abe2340b93141123312baf5414b"
1282 importable = false
1283
1284 [[audits.darling]]
1285 who = "Mike Hommey <mh+mozilla@glandium.org>"
1286 criteria = "safe-to-deploy"
1287 delta = "0.13.4 -> 0.14.2"
1288
1289 [[audits.darling]]
1290 who = "Mike Hommey <mh+mozilla@glandium.org>"
1291 criteria = "safe-to-deploy"
1292 delta = "0.14.2 -> 0.14.3"
1293
1294 [[audits.darling]]
1295 who = "Mike Hommey <mh+mozilla@glandium.org>"
1296 criteria = "safe-to-deploy"
1297 delta = "0.14.3 -> 0.20.1"
1298
1299 [[audits.darling_core]]
1300 who = "Mike Hommey <mh+mozilla@glandium.org>"
1301 criteria = "safe-to-deploy"
1302 delta = "0.13.4 -> 0.14.2"
1303
1304 [[audits.darling_core]]
1305 who = "Mike Hommey <mh+mozilla@glandium.org>"
1306 criteria = "safe-to-deploy"
1307 delta = "0.14.2 -> 0.14.3"
1308
1309 [[audits.darling_core]]
1310 who = "Mike Hommey <mh+mozilla@glandium.org>"
1311 criteria = "safe-to-deploy"
1312 delta = "0.14.3 -> 0.20.1"
1313
1314 [[audits.darling_macro]]
1315 who = "Mike Hommey <mh+mozilla@glandium.org>"
1316 criteria = "safe-to-deploy"
1317 delta = "0.13.4 -> 0.14.2"
1318
1319 [[audits.darling_macro]]
1320 who = "Mike Hommey <mh+mozilla@glandium.org>"
1321 criteria = "safe-to-deploy"
1322 delta = "0.14.2 -> 0.14.3"
1323
1324 [[audits.darling_macro]]
1325 who = "Mike Hommey <mh+mozilla@glandium.org>"
1326 criteria = "safe-to-deploy"
1327 delta = "0.14.3 -> 0.20.1"
1328
1329 [[audits.data-encoding]]
1330 who = "Mike Hommey <mh+mozilla@glandium.org>"
1331 criteria = "safe-to-deploy"
1332 delta = "2.3.2 -> 2.3.3"
1333
1334 [[audits.debugid]]
1335 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1336 criteria = "safe-to-deploy"
1337 version = "0.8.0"
1338 notes = "This crates was written by Sentry and I've fully audited it as Firefox crash reporting machinery relies on it."
1339
1340 [[audits.derive_arbitrary]]
1341 who = "Mike Hommey <mh+mozilla@glandium.org>"
1342 criteria = "safe-to-run"
1343 delta = "1.1.0 -> 1.1.1"
1344
1345 [[audits.derive_arbitrary]]
1346 who = "Mike Hommey <mh+mozilla@glandium.org>"
1347 criteria = "safe-to-run"
1348 delta = "1.1.1 -> 1.1.3"
1349
1350 [[audits.derive_arbitrary]]
1351 who = "Mike Hommey <mh+mozilla@glandium.org>"
1352 criteria = "safe-to-run"
1353 delta = "1.1.3 -> 1.2.1"
1354
1355 [[audits.derive_arbitrary]]
1356 who = "Mike Hommey <mh+mozilla@glandium.org>"
1357 criteria = "safe-to-run"
1358 delta = "1.2.1 -> 1.2.3"
1359
1360 [[audits.derive_arbitrary]]
1361 who = "Mike Hommey <mh+mozilla@glandium.org>"
1362 criteria = "safe-to-run"
1363 delta = "1.3.0 -> 1.3.1"
1364
1365 [[audits.derive_more]]
1366 who = "Mike Hommey <mh+mozilla@glandium.org>"
1367 criteria = "safe-to-deploy"
1368 delta = "0.99.17 -> 1.0.0-beta.2"
1369
1370 [[audits.devd-rs]]
1371 who = "Mike Hommey <mh+mozilla@glandium.org>"
1372 criteria = "safe-to-deploy"
1373 delta = "0.3.4 -> 0.3.5"
1374
1375 [[audits.devd-rs]]
1376 who = "Mike Hommey <mh+mozilla@glandium.org>"
1377 criteria = "safe-to-deploy"
1378 delta = "0.3.5 -> 0.3.6"
1379
1380 [[audits.digest]]
1381 who = "Mike Hommey <mh+mozilla@glandium.org>"
1382 criteria = "safe-to-deploy"
1383 delta = "0.10.3 -> 0.10.6"
1384
1385 [[audits.diplomat]]
1386 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1387 criteria = "safe-to-deploy"
1388 version = "0.5.2"
1389 notes = "This crate is FFI wrapper generator using by ICU4X ffi libraries. This uses unsafe code to convert paramenters, I have reviewed this and generated headers."
1390
1391 [[audits.diplomat]]
1392 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1393 criteria = "safe-to-deploy"
1394 delta = "0.5.2 -> 0.5.2@git:8d125999893fedfdf30595e97334c21ec4b18da9"
1395
1396 [[audits.diplomat]]
1397 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1398 criteria = "safe-to-deploy"
1399 delta = "0.5.2 -> 0.7.0"
1400
1401 [[audits.diplomat-runtime]]
1402 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1403 criteria = "safe-to-deploy"
1404 version = "0.5.2"
1405 notes = "This crate is FFI wrapper generator runtime using by ICU4X ffi libraries. This uses unsafe code for memory access of FFI. I have reviewed carefully."
1406
1407 [[audits.diplomat-runtime]]
1408 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1409 criteria = "safe-to-deploy"
1410 delta = "0.5.2 -> 0.5.2@git:8d125999893fedfdf30595e97334c21ec4b18da9"
1411
1412 [[audits.diplomat-runtime]]
1413 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1414 criteria = "safe-to-deploy"
1415 delta = "0.5.2 -> 0.7.0"
1416
1417 [[audits.diplomat_core]]
1418 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1419 criteria = "safe-to-deploy"
1420 version = "0.5.2"
1421 notes = "This crate contains unsafe code, no network and no file access."
1422
1423 [[audits.diplomat_core]]
1424 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1425 criteria = "safe-to-deploy"
1426 delta = "0.5.2 -> 0.5.2@git:8d125999893fedfdf30595e97334c21ec4b18da9"
1427
1428 [[audits.diplomat_core]]
1429 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1430 criteria = "safe-to-deploy"
1431 delta = "0.5.2 -> 0.7.0"
1432
1433 [[audits.displaydoc]]
1434 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
1435 criteria = "safe-to-deploy"
1436 version = "0.2.3"
1437 notes = """
1438 This crate is convenient macros to implement core::fmt::Display trait.
1439 Although `unsafe` is used for test code to call `libc::abort()`, it has no `unsafe` code in this crate. And there is no file access.
1440 It meets the criteria for safe-to-deploy.
1441 """
1442
1443 [[audits.displaydoc]]
1444 who = "Mike Hommey <mh+mozilla@glandium.org>"
1445 criteria = "safe-to-deploy"
1446 delta = "0.2.3 -> 0.2.4"
1447
1448 [[audits.dogear]]
1449 who = "Sammy Khamis <skhamis@mozilla.com>"
1450 criteria = "safe-to-deploy"
1451 delta = "0.4.0 -> 0.5.0"
1452 notes = "The repository for this crate belongs in the Mozilla org."
1453
1454 [[audits.dtoa-short]]
1455 who = "Bobby Holley <bobbyholley@gmail.com>"
1456 criteria = "safe-to-deploy"
1457 version = "0.3.3"
1458
1459 [[audits.dwrote]]
1460 who = "Bobby Holley <bobbyholley@gmail.com>"
1461 criteria = "safe-to-deploy"
1462 version = "0.11.0"
1463 notes = "All code written or reviewed by Mozilla staff."
1464
1465 [[audits.either]]
1466 who = "Mike Hommey <mh+mozilla@glandium.org>"
1467 criteria = "safe-to-deploy"
1468 delta = "1.6.1 -> 1.7.0"
1469
1470 [[audits.either]]
1471 who = "Mike Hommey <mh+mozilla@glandium.org>"
1472 criteria = "safe-to-deploy"
1473 delta = "1.7.0 -> 1.8.0"
1474
1475 [[audits.either]]
1476 who = "Mike Hommey <mh+mozilla@glandium.org>"
1477 criteria = "safe-to-deploy"
1478 delta = "1.8.0 -> 1.8.1"
1479
1480 [[audits.encoding_c]]
1481 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
1482 criteria = "safe-to-deploy"
1483 version = "0.9.8"
1484 notes = "I, Henri Sivonen, wrote encoding_c for Gecko even though it is published via crates.io. There are two caveats: 1) the C API is designed to be used together with mozilla::Span and is unidiomatic for zero-length inputs otherwise. 2) It is idiomatic in C and C++ to pass uninitialized buffers as output buffers. This is generally documented to be UB in Rust, but idiomatic C and C++ usage here relies on this not actually being UB for buffers of integers (which these buffers are). See https://github.com/hsivonen/encoding_rs/issues/79#issuecomment-1211870361"
1485
1486 [[audits.encoding_c_mem]]
1487 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
1488 criteria = "safe-to-deploy"
1489 version = "0.2.6"
1490 notes = """
1491 I, Henri Sivonen, wrote encoding_c_mem for Gecko even though it is published via crates.io. There are two caveats: 1) the C API is designed to be used together with mozilla::Span and is unidiomatic for zero-length inputs otherwise. 2) It is idiomatic in C and C
1492 ++ to pass uninitialized buffers as output buffers. This is generally documented to be UB in Rust, but idiomatic C and C++ usage here relies on this not actually being UB for buffers of integers (which these buffers are). See https://github.com/hsivonen/encoding_rs/i
1493 ssues/79#issuecomment-1211870361
1494 """
1495
1496 [[audits.encoding_rs]]
1497 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
1498 criteria = "safe-to-deploy"
1499 version = "0.8.31"
1500 notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
1501
1502 [[audits.encoding_rs]]
1503 who = "Mike Hommey <mh+mozilla@glandium.org>"
1504 criteria = "safe-to-deploy"
1505 delta = "0.8.31 -> 0.8.32"
1506
1507 [[audits.enum-primitive-derive]]
1508 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1509 criteria = "safe-to-deploy"
1510 version = "0.2.2"
1511
1512 [[audits.enumset]]
1513 who = "Mike Hommey <mh+mozilla@glandium.org>"
1514 criteria = "safe-to-deploy"
1515 delta = "1.0.11 -> 1.0.12"
1516
1517 [[audits.enumset]]
1518 who = "Mike Hommey <mh+mozilla@glandium.org>"
1519 criteria = "safe-to-deploy"
1520 delta = "1.0.12 -> 1.1.2"
1521
1522 [[audits.enumset_derive]]
1523 who = "Mike Hommey <mh+mozilla@glandium.org>"
1524 criteria = "safe-to-deploy"
1525 delta = "0.6.0 -> 0.6.1"
1526
1527 [[audits.enumset_derive]]
1528 who = "Mike Hommey <mh+mozilla@glandium.org>"
1529 criteria = "safe-to-deploy"
1530 delta = "0.6.1 -> 0.8.1"
1531
1532 [[audits.env_logger]]
1533 who = "Mike Hommey <mh+mozilla@glandium.org>"
1534 criteria = "safe-to-deploy"
1535 delta = "0.9.0 -> 0.9.3"
1536
1537 [[audits.env_logger]]
1538 who = "Nicolas Silva <nical@fastmail.com>"
1539 criteria = "safe-to-deploy"
1540 delta = "0.9.3 -> 0.10.0"
1541
1542 [[audits.errno]]
1543 who = "Mike Hommey <mh+mozilla@glandium.org>"
1544 criteria = "safe-to-deploy"
1545 delta = "0.3.1 -> 0.3.3"
1546
1547 [[audits.extend]]
1548 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
1549 criteria = "safe-to-deploy"
1550 version = "1.1.2"
1551 notes = "Inspected the crate and noted that the impl block comes directly from the proc-macro input.  If no new code can be added by this crate, I don't think there can be any issues."
1552
1553 [[audits.extend]]
1554 who = "Mike Hommey <mh+mozilla@glandium.org>"
1555 criteria = "safe-to-deploy"
1556 delta = "1.1.2 -> 1.2.0"
1557
1558 [[audits.fallible_collections]]
1559 who = "Mike Hommey <mh+mozilla@glandium.org>"
1560 criteria = "safe-to-deploy"
1561 delta = "0.4.4 -> 0.4.5"
1562
1563 [[audits.fallible_collections]]
1564 who = "Mike Hommey <mh+mozilla@glandium.org>"
1565 criteria = "safe-to-deploy"
1566 delta = "0.4.5 -> 0.4.6"
1567 notes = "The changes in this version are mine."
1568
1569 [[audits.fastrand]]
1570 who = "Mike Hommey <mh+mozilla@glandium.org>"
1571 criteria = "safe-to-deploy"
1572 delta = "1.7.0 -> 1.8.0"
1573
1574 [[audits.fastrand]]
1575 who = "Mike Hommey <mh+mozilla@glandium.org>"
1576 criteria = "safe-to-deploy"
1577 delta = "1.8.0 -> 1.9.0"
1578
1579 [[audits.fastrand]]
1580 who = "Mike Hommey <mh+mozilla@glandium.org>"
1581 criteria = "safe-to-deploy"
1582 delta = "1.9.0 -> 2.0.0"
1583
1584 [[audits.filetime_win]]
1585 who = "Nick Alexander <nalexander@mozilla.com>"
1586 criteria = "safe-to-deploy"
1587 version = "0.2.0"
1588 notes = """
1589 filetime_win was written by Adam Gashlin for Mozilla's use.  The `unsafe` code
1590 blocks in filetime_win 0.2.0 are straight-forward invocations of `mem::zeroed`
1591 and expected invocations of Win32 APIs (with error handling as appropriate).
1592 """
1593
1594 [[audits.flagset]]
1595 who = "Ryan Hunt <rhunt@eqrion.net>"
1596 criteria = "safe-to-deploy"
1597 version = "0.4.3"
1598 notes = "Uses no ambient capabilities, vetted the one instance of unsafe."
1599
1600 [[audits.flate2]]
1601 who = "Mike Hommey <mh+mozilla@glandium.org>"
1602 criteria = "safe-to-deploy"
1603 delta = "1.0.24 -> 1.0.25"
1604
1605 [[audits.fluent]]
1606 who = "Zibi Braniecki <zibi@unicode.org>"
1607 criteria = "safe-to-deploy"
1608 version = "0.16.0"
1609
1610 [[audits.fluent-bundle]]
1611 who = "Zibi Braniecki <zibi@unicode.org>"
1612 criteria = "safe-to-deploy"
1613 version = "0.15.2"
1614
1615 [[audits.fluent-fallback]]
1616 who = "Zibi Braniecki <zibi@unicode.org>"
1617 criteria = "safe-to-deploy"
1618 version = "0.6.0"
1619
1620 [[audits.fluent-fallback]]
1621 who = "Greg Tatum <tatum.creative@gmail.com>"
1622 criteria = "safe-to-deploy"
1623 delta = "0.6.0 -> 0.7.0"
1624
1625 [[audits.fluent-langneg]]
1626 who = "Zibi Braniecki <zibi@unicode.org>"
1627 criteria = "safe-to-deploy"
1628 version = "0.13.0"
1629
1630 [[audits.fluent-pseudo]]
1631 who = "Zibi Braniecki <zibi@unicode.org>"
1632 criteria = "safe-to-deploy"
1633 version = "0.3.1"
1634
1635 [[audits.fluent-syntax]]
1636 who = "Zibi Braniecki <zibi@unicode.org>"
1637 criteria = "safe-to-deploy"
1638 version = "0.11.0"
1639
1640 [[audits.fluent-testing]]
1641 who = "Zibi Braniecki <zibi@unicode.org>"
1642 criteria = "safe-to-run"
1643 version = "0.0.2"
1644
1645 [[audits.fluent-testing]]
1646 who = "Greg Tatum <tatum.creative@gmail.com>"
1647 criteria = "safe-to-run"
1648 delta = "0.0.2 -> 0.0.3"
1649
1650 [[audits.fnv]]
1651 who = "Bobby Holley <bobbyholley@gmail.com>"
1652 criteria = "safe-to-deploy"
1653 version = "1.0.7"
1654 notes = "Simple hasher implementation with no unsafe code."
1655
1656 [[audits.foreign-types]]
1657 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
1658 criteria = "safe-to-deploy"
1659 delta = "0.3.2 -> 0.5.0"
1660
1661 [[audits.foreign-types-macros]]
1662 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
1663 criteria = "safe-to-deploy"
1664 version = "0.2.3"
1665
1666 [[audits.foreign-types-shared]]
1667 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
1668 criteria = "safe-to-deploy"
1669 delta = "0.1.1 -> 0.3.1"
1670
1671 [[audits.form_urlencoded]]
1672 who = "Valentin Gosu <valentin.gosu@gmail.com>"
1673 criteria = "safe-to-deploy"
1674 version = "1.2.0"
1675
1676 [[audits.form_urlencoded]]
1677 who = "Valentin Gosu <valentin.gosu@gmail.com>"
1678 criteria = "safe-to-deploy"
1679 delta = "1.2.0 -> 1.2.1"
1680
1681 [[audits.fs-err]]
1682 who = "Mike Hommey <mh+mozilla@glandium.org>"
1683 criteria = "safe-to-deploy"
1684 delta = "2.7.0 -> 2.8.1"
1685
1686 [[audits.fs-err]]
1687 who = "Mike Hommey <mh+mozilla@glandium.org>"
1688 criteria = "safe-to-deploy"
1689 delta = "2.8.1 -> 2.9.0"
1690
1691 [[audits.futures]]
1692 who = "Mike Hommey <mh+mozilla@glandium.org>"
1693 criteria = "safe-to-deploy"
1694 delta = "0.3.21 -> 0.3.23"
1695
1696 [[audits.futures]]
1697 who = "Mike Hommey <mh+mozilla@glandium.org>"
1698 criteria = "safe-to-deploy"
1699 delta = "0.3.23 -> 0.3.25"
1700
1701 [[audits.futures]]
1702 who = "Mike Hommey <mh+mozilla@glandium.org>"
1703 criteria = "safe-to-deploy"
1704 delta = "0.3.25 -> 0.3.26"
1705
1706 [[audits.futures]]
1707 who = "Mike Hommey <mh+mozilla@glandium.org>"
1708 criteria = "safe-to-deploy"
1709 delta = "0.3.26 -> 0.3.28"
1710
1711 [[audits.futures-channel]]
1712 who = "Mike Hommey <mh+mozilla@glandium.org>"
1713 criteria = "safe-to-deploy"
1714 delta = "0.3.21 -> 0.3.23"
1715
1716 [[audits.futures-channel]]
1717 who = "Mike Hommey <mh+mozilla@glandium.org>"
1718 criteria = "safe-to-deploy"
1719 delta = "0.3.23 -> 0.3.25"
1720
1721 [[audits.futures-channel]]
1722 who = "Mike Hommey <mh+mozilla@glandium.org>"
1723 criteria = "safe-to-deploy"
1724 delta = "0.3.25 -> 0.3.26"
1725
1726 [[audits.futures-channel]]
1727 who = "Bobby Holley <bobbyholley@gmail.com>"
1728 criteria = "safe-to-deploy"
1729 delta = "0.3.27 -> 0.3.26"
1730
1731 [[audits.futures-channel]]
1732 who = "Mike Hommey <mh+mozilla@glandium.org>"
1733 criteria = "safe-to-deploy"
1734 delta = "0.3.27 -> 0.3.28"
1735
1736 [[audits.futures-core]]
1737 who = "Mike Hommey <mh+mozilla@glandium.org>"
1738 criteria = "safe-to-deploy"
1739 delta = "0.3.21 -> 0.3.23"
1740
1741 [[audits.futures-core]]
1742 who = "Mike Hommey <mh+mozilla@glandium.org>"
1743 criteria = "safe-to-deploy"
1744 delta = "0.3.23 -> 0.3.25"
1745
1746 [[audits.futures-core]]
1747 who = "Mike Hommey <mh+mozilla@glandium.org>"
1748 criteria = "safe-to-deploy"
1749 delta = "0.3.25 -> 0.3.26"
1750
1751 [[audits.futures-core]]
1752 who = "Bobby Holley <bobbyholley@gmail.com>"
1753 criteria = "safe-to-deploy"
1754 delta = "0.3.27 -> 0.3.26"
1755
1756 [[audits.futures-core]]
1757 who = "Mike Hommey <mh+mozilla@glandium.org>"
1758 criteria = "safe-to-deploy"
1759 delta = "0.3.27 -> 0.3.28"
1760
1761 [[audits.futures-executor]]
1762 who = "Mike Hommey <mh+mozilla@glandium.org>"
1763 criteria = "safe-to-deploy"
1764 delta = "0.3.21 -> 0.3.23"
1765
1766 [[audits.futures-executor]]
1767 who = "Mike Hommey <mh+mozilla@glandium.org>"
1768 criteria = "safe-to-deploy"
1769 delta = "0.3.23 -> 0.3.25"
1770
1771 [[audits.futures-executor]]
1772 who = "Mike Hommey <mh+mozilla@glandium.org>"
1773 criteria = "safe-to-deploy"
1774 delta = "0.3.25 -> 0.3.26"
1775
1776 [[audits.futures-executor]]
1777 who = "Bobby Holley <bobbyholley@gmail.com>"
1778 criteria = "safe-to-deploy"
1779 delta = "0.3.27 -> 0.3.23"
1780
1781 [[audits.futures-executor]]
1782 who = "Mike Hommey <mh+mozilla@glandium.org>"
1783 criteria = "safe-to-deploy"
1784 delta = "0.3.27 -> 0.3.28"
1785
1786 [[audits.futures-io]]
1787 who = "Mike Hommey <mh+mozilla@glandium.org>"
1788 criteria = "safe-to-deploy"
1789 delta = "0.3.21 -> 0.3.23"
1790
1791 [[audits.futures-io]]
1792 who = "Mike Hommey <mh+mozilla@glandium.org>"
1793 criteria = "safe-to-deploy"
1794 delta = "0.3.23 -> 0.3.25"
1795
1796 [[audits.futures-io]]
1797 who = "Mike Hommey <mh+mozilla@glandium.org>"
1798 criteria = "safe-to-deploy"
1799 delta = "0.3.25 -> 0.3.26"
1800
1801 [[audits.futures-io]]
1802 who = "Bobby Holley <bobbyholley@gmail.com>"
1803 criteria = "safe-to-deploy"
1804 delta = "0.3.27 -> 0.3.23"
1805
1806 [[audits.futures-io]]
1807 who = "Mike Hommey <mh+mozilla@glandium.org>"
1808 criteria = "safe-to-deploy"
1809 delta = "0.3.27 -> 0.3.28"
1810
1811 [[audits.futures-macro]]
1812 who = "Mike Hommey <mh+mozilla@glandium.org>"
1813 criteria = "safe-to-deploy"
1814 delta = "0.3.21 -> 0.3.23"
1815
1816 [[audits.futures-macro]]
1817 who = "Mike Hommey <mh+mozilla@glandium.org>"
1818 criteria = "safe-to-deploy"
1819 delta = "0.3.23 -> 0.3.25"
1820
1821 [[audits.futures-macro]]
1822 who = "Mike Hommey <mh+mozilla@glandium.org>"
1823 criteria = "safe-to-deploy"
1824 delta = "0.3.25 -> 0.3.26"
1825
1826 [[audits.futures-macro]]
1827 who = "Mike Hommey <mh+mozilla@glandium.org>"
1828 criteria = "safe-to-deploy"
1829 delta = "0.3.26 -> 0.3.28"
1830
1831 [[audits.futures-sink]]
1832 who = "Mike Hommey <mh+mozilla@glandium.org>"
1833 criteria = "safe-to-deploy"
1834 delta = "0.3.21 -> 0.3.23"
1835
1836 [[audits.futures-sink]]
1837 who = "Mike Hommey <mh+mozilla@glandium.org>"
1838 criteria = "safe-to-deploy"
1839 delta = "0.3.23 -> 0.3.25"
1840
1841 [[audits.futures-sink]]
1842 who = "Mike Hommey <mh+mozilla@glandium.org>"
1843 criteria = "safe-to-deploy"
1844 delta = "0.3.25 -> 0.3.26"
1845
1846 [[audits.futures-sink]]
1847 who = "Bobby Holley <bobbyholley@gmail.com>"
1848 criteria = "safe-to-deploy"
1849 delta = "0.3.27 -> 0.3.23"
1850
1851 [[audits.futures-sink]]
1852 who = "Mike Hommey <mh+mozilla@glandium.org>"
1853 criteria = "safe-to-deploy"
1854 delta = "0.3.27 -> 0.3.28"
1855
1856 [[audits.futures-task]]
1857 who = "Mike Hommey <mh+mozilla@glandium.org>"
1858 criteria = "safe-to-deploy"
1859 delta = "0.3.21 -> 0.3.23"
1860
1861 [[audits.futures-task]]
1862 who = "Mike Hommey <mh+mozilla@glandium.org>"
1863 criteria = "safe-to-deploy"
1864 delta = "0.3.23 -> 0.3.25"
1865
1866 [[audits.futures-task]]
1867 who = "Mike Hommey <mh+mozilla@glandium.org>"
1868 criteria = "safe-to-deploy"
1869 delta = "0.3.25 -> 0.3.26"
1870
1871 [[audits.futures-task]]
1872 who = "Mike Hommey <mh+mozilla@glandium.org>"
1873 criteria = "safe-to-deploy"
1874 delta = "0.3.26 -> 0.3.28"
1875
1876 [[audits.futures-util]]
1877 who = "Mike Hommey <mh+mozilla@glandium.org>"
1878 criteria = "safe-to-deploy"
1879 delta = "0.3.21 -> 0.3.23"
1880
1881 [[audits.futures-util]]
1882 who = "Mike Hommey <mh+mozilla@glandium.org>"
1883 criteria = "safe-to-deploy"
1884 delta = "0.3.23 -> 0.3.25"
1885
1886 [[audits.futures-util]]
1887 who = "Mike Hommey <mh+mozilla@glandium.org>"
1888 criteria = "safe-to-deploy"
1889 delta = "0.3.25 -> 0.3.26"
1890
1891 [[audits.futures-util]]
1892 who = "Mike Hommey <mh+mozilla@glandium.org>"
1893 criteria = "safe-to-deploy"
1894 delta = "0.3.26 -> 0.3.28"
1895
1896 [[audits.fxhash]]
1897 who = "Bobby Holley <bobbyholley@gmail.com>"
1898 criteria = "safe-to-deploy"
1899 version = "0.2.1"
1900 notes = "Straightforward crate with no unsafe code, does what it says on the tin."
1901
1902 [[audits.generic-array]]
1903 who = "Mike Hommey <mh+mozilla@glandium.org>"
1904 criteria = "safe-to-deploy"
1905 delta = "0.14.5 -> 0.14.6"
1906
1907 [[audits.getrandom]]
1908 who = "Mike Hommey <mh+mozilla@glandium.org>"
1909 criteria = "safe-to-deploy"
1910 delta = "0.2.6 -> 0.2.7"
1911
1912 [[audits.getrandom]]
1913 who = "Mike Hommey <mh+mozilla@glandium.org>"
1914 criteria = "safe-to-deploy"
1915 delta = "0.2.7 -> 0.2.8"
1916
1917 [[audits.getrandom]]
1918 who = "Yannis Juglaret <yjuglaret@mozilla.com>"
1919 criteria = "safe-to-deploy"
1920 delta = "0.2.8 -> 0.2.9"
1921
1922 [[audits.getrandom]]
1923 who = "Simon Friedberger <simon@mozilla.com>"
1924 criteria = "safe-to-deploy"
1925 delta = "0.2.10 -> 0.2.11"
1926
1927 [[audits.gleam]]
1928 who = "Jamie Nicol <jnicol@mozilla.com>"
1929 criteria = "safe-to-deploy"
1930 delta = "0.13.1 -> 0.15.0"
1931
1932 [[audits.glob]]
1933 who = "Mike Hommey <mh+mozilla@glandium.org>"
1934 criteria = "safe-to-deploy"
1935 delta = "0.3.0 -> 0.3.1"
1936
1937 [[audits.glsl]]
1938 who = "Mike Hommey <mh+mozilla@glandium.org>"
1939 criteria = "safe-to-deploy"
1940 delta = "6.0.1 -> 6.0.2"
1941 notes = "I'm the author of the changes in this version of the crate."
1942
1943 [[audits.goblin]]
1944 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
1945 criteria = "safe-to-deploy"
1946 delta = "0.1.3 -> 0.5.4"
1947 notes = "Several bugfixes since 2019. This version is also in use by Mozilla's crash reporting tooling, e.g. minidump-writer"
1948
1949 [[audits.goblin]]
1950 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1951 criteria = "safe-to-deploy"
1952 delta = "0.5.4 -> 0.6.0"
1953 notes = "Mostly bug fixes and some added functionality"
1954
1955 [[audits.goblin]]
1956 who = "Gabriele Svelto <gsvelto@mozilla.com>"
1957 criteria = "safe-to-deploy"
1958 delta = "0.6.0 -> 0.7.1"
1959
1960 [[audits.gpu-alloc]]
1961 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
1962 criteria = "safe-to-deploy"
1963 delta = "0.5.3 -> 0.6.0"
1964
1965 [[audits.gpu-alloc-types]]
1966 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
1967 criteria = "safe-to-deploy"
1968 delta = "0.2.0 -> 0.3.0"
1969
1970 [[audits.gpu-descriptor]]
1971 who = "Mike Hommey <mh+mozilla@glandium.org>"
1972 criteria = "safe-to-deploy"
1973 delta = "0.2.2 -> 0.2.3"
1974
1975 [[audits.guid_win]]
1976 who = "Bobby Holley <bobbyholley@gmail.com>"
1977 criteria = "safe-to-deploy"
1978 version = "0.2.0"
1979 notes = """
1980 This crate has some unsafe code for the FFI bits, which I've reviewed carefully.
1981 It uses the deprecated mem::uninitialized(), which is generally sketchy. However
1982 the usage is pretty straightforward and while it's technically UB, it seems no
1983 more likely to lead to miscompilation than any other use of mem::uninitialized.
1984 """
1985
1986 [[audits.h2]]
1987 who = "Mike Hommey <mh+mozilla@glandium.org>"
1988 criteria = "safe-to-run"
1989 delta = "0.3.13 -> 0.3.14"
1990
1991 [[audits.h2]]
1992 who = "Mike Hommey <mh+mozilla@glandium.org>"
1993 criteria = "safe-to-run"
1994 delta = "0.3.14 -> 0.3.15"
1995
1996 [[audits.half]]
1997 who = "John M. Schanck <jschanck@mozilla.com>"
1998 criteria = "safe-to-deploy"
1999 version = "1.8.2"
2000 notes = """
2001 This crate contains unsafe code for bitwise casts to/from binary16 floating-point
2002 format. I've reviewed these and found no issues. There are no uses of ambient
2003 capabilities.
2004 """
2005
2006 [[audits.hashbrown]]
2007 who = "Mike Hommey <mh+mozilla@glandium.org>"
2008 criteria = "safe-to-deploy"
2009 version = "0.12.3"
2010 notes = "This version is used in rust's libstd, so effectively we're already trusting it"
2011
2012 [[audits.hashlink]]
2013 who = "Mike Hommey <mh+mozilla@glandium.org>"
2014 criteria = "safe-to-deploy"
2015 delta = "0.7.0 -> 0.8.1"
2016
2017 [[audits.headers]]
2018 who = "Mike Hommey <mh+mozilla@glandium.org>"
2019 criteria = "safe-to-run"
2020 delta = "0.3.7 -> 0.3.8"
2021
2022 [[audits.headers-core]]
2023 who = "Bobby Holley <bobbyholley@gmail.com>"
2024 criteria = "safe-to-deploy"
2025 version = "0.2.0"
2026 notes = "Trivial crate, no unsafe code."
2027
2028 [[audits.heck]]
2029 who = "Mike Hommey <mh+mozilla@glandium.org>"
2030 criteria = "safe-to-deploy"
2031 delta = "0.4.0 -> 0.4.1"
2032
2033 [[audits.hermit-abi]]
2034 who = "Mike Hommey <mh+mozilla@glandium.org>"
2035 criteria = "safe-to-deploy"
2036 delta = "0.1.19 -> 0.2.6"
2037
2038 [[audits.hex]]
2039 who = "Simon Friedberger <simon@mozilla.com>"
2040 criteria = "safe-to-deploy"
2041 version = "0.4.3"
2042
2043 [[audits.http]]
2044 who = "Mike Hommey <mh+mozilla@glandium.org>"
2045 criteria = "safe-to-run"
2046 delta = "0.2.8 -> 0.2.9"
2047
2048 [[audits.httparse]]
2049 who = "Mike Hommey <mh+mozilla@glandium.org>"
2050 criteria = "safe-to-run"
2051 delta = "1.7.1 -> 1.8.0"
2052
2053 [[audits.hyper]]
2054 who = "Mike Hommey <mh+mozilla@glandium.org>"
2055 criteria = "safe-to-run"
2056 delta = "0.14.19 -> 0.14.20"
2057
2058 [[audits.hyper]]
2059 who = "Mike Hommey <mh+mozilla@glandium.org>"
2060 criteria = "safe-to-run"
2061 delta = "0.14.20 -> 0.14.22"
2062
2063 [[audits.hyper]]
2064 who = "Mike Hommey <mh+mozilla@glandium.org>"
2065 criteria = "safe-to-run"
2066 delta = "0.14.22 -> 0.14.23"
2067
2068 [[audits.hyper]]
2069 who = "Mike Hommey <mh+mozilla@glandium.org>"
2070 criteria = "safe-to-run"
2071 delta = "0.14.23 -> 0.14.24"
2072
2073 [[audits.icu_capi]]
2074 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2075 criteria = "safe-to-deploy"
2076 version = "1.2.2"
2077 notes = "This crate is C/C++ FFI for ICU4X using diplomat crate. no unsafe and no file access etc on this crate."
2078
2079 [[audits.icu_capi]]
2080 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2081 criteria = "safe-to-deploy"
2082 delta = "1.2.2 -> 1.4.0"
2083
2084 [[audits.icu_collections]]
2085 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2086 criteria = "safe-to-deploy"
2087 version = "1.2.0"
2088 notes = "This crate is used by ICU4X for internal data structure. There is no fileaccess and network access. This uses unsafe block, but we confirm data is valid before."
2089
2090 [[audits.icu_collections]]
2091 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2092 criteria = "safe-to-deploy"
2093 delta = "1.2.0 -> 1.4.0"
2094
2095 [[audits.icu_locid]]
2096 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2097 criteria = "safe-to-deploy"
2098 version = "1.2.0"
2099 notes = "This has unsafe block to handle ascii string in utf-8 string. I've vetted the one instance of unsafe code."
2100
2101 [[audits.icu_locid]]
2102 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2103 criteria = "safe-to-deploy"
2104 delta = "1.2.0 -> 1.4.0"
2105
2106 [[audits.icu_locid_transform]]
2107 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2108 criteria = "safe-to-deploy"
2109 version = "1.4.0"
2110 notes = "This crate doesn't contain network and file access. Although this has unsafe block, the reason is added in the comment block. I audited code."
2111
2112 [[audits.icu_provider]]
2113 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2114 criteria = "safe-to-deploy"
2115 version = "1.2.0"
2116 notes = "Although this has unsafe block, this has a commnet why this is safety and I audited code. Also, this doesn't have file access and network access."
2117
2118 [[audits.icu_provider]]
2119 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2120 criteria = "safe-to-deploy"
2121 delta = "1.2.0 -> 1.4.0"
2122
2123 [[audits.icu_provider_adapters]]
2124 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2125 criteria = "safe-to-deploy"
2126 version = "1.2.0"
2127 notes = "This is one of ICU4X data provider crates that depends on data type. This has no unsafe code and uses no ambient capabilities."
2128
2129 [[audits.icu_provider_adapters]]
2130 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2131 criteria = "safe-to-deploy"
2132 delta = "1.2.0 -> 1.4.0"
2133
2134 [[audits.icu_provider_macros]]
2135 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2136 criteria = "safe-to-deploy"
2137 version = "1.2.0"
2138 notes = "This crate is macros for ICU4X's data provider implementer. This has no unsafe code and uses no ambient capabilities."
2139
2140 [[audits.icu_provider_macros]]
2141 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2142 criteria = "safe-to-deploy"
2143 delta = "1.2.0 -> 1.2.0@git:14e9a3a9857be74582abe2dfa7ab799c5eaac873"
2144
2145 [[audits.icu_provider_macros]]
2146 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2147 criteria = "safe-to-deploy"
2148 delta = "1.2.0 -> 1.4.0"
2149
2150 [[audits.icu_segmenter]]
2151 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2152 criteria = "safe-to-deploy"
2153 version = "1.2.1"
2154 notes = "Original authors are Makoto Kato and Ting-Yu Lin who work at Mozilla. This crate uses unsafe to matrix calculation, but it is safety to check length. And there is no filesystem / network access."
2155
2156 [[audits.icu_segmenter]]
2157 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2158 criteria = "safe-to-deploy"
2159 delta = "1.2.1 -> 1.4.0"
2160
2161 [[audits.icu_segmenter_data]]
2162 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2163 criteria = "safe-to-deploy"
2164 version = "1.4.0"
2165 notes = "This crate is data only for icu_segmenter. There is no filesystem / network access."
2166
2167 [[audits.idna]]
2168 who = "Bobby Holley <bobbyholley@gmail.com>"
2169 criteria = "safe-to-deploy"
2170 delta = "0.3.0 -> 0.2.3"
2171 notes = "Backwards diff with some algorithm changes, no unsafe code."
2172
2173 [[audits.idna]]
2174 who = "Valentin Gosu <valentin.gosu@gmail.com>"
2175 criteria = "safe-to-deploy"
2176 delta = "0.4.0 -> 0.5.0"
2177
2178 [[audits.indexmap]]
2179 who = "Mike Hommey <mh+mozilla@glandium.org>"
2180 criteria = "safe-to-deploy"
2181 delta = "1.8.2 -> 1.9.1"
2182
2183 [[audits.indexmap]]
2184 who = "Mike Hommey <mh+mozilla@glandium.org>"
2185 criteria = "safe-to-deploy"
2186 delta = "1.9.1 -> 1.9.2"
2187
2188 [[audits.inherent]]
2189 who = "Mike Hommey <mh+mozilla@glandium.org>"
2190 criteria = "safe-to-deploy"
2191 delta = "1.0.1 -> 1.0.2"
2192
2193 [[audits.inherent]]
2194 who = "Mike Hommey <mh+mozilla@glandium.org>"
2195 criteria = "safe-to-deploy"
2196 delta = "1.0.2 -> 1.0.3"
2197
2198 [[audits.inherent]]
2199 who = "Mike Hommey <mh+mozilla@glandium.org>"
2200 criteria = "safe-to-deploy"
2201 delta = "1.0.3 -> 1.0.4"
2202
2203 [[audits.inplace_it]]
2204 who = "Mike Hommey <mh+mozilla@glandium.org>"
2205 criteria = "safe-to-deploy"
2206 delta = "0.3.3 -> 0.3.4"
2207
2208 [[audits.intl-memoizer]]
2209 who = "Zibi Braniecki <zibi@unicode.org>"
2210 criteria = "safe-to-deploy"
2211 version = "0.5.1"
2212
2213 [[audits.intl_pluralrules]]
2214 who = "Zibi Braniecki <zibi@unicode.org>"
2215 criteria = "safe-to-deploy"
2216 version = "7.0.1"
2217
2218 [[audits.intl_pluralrules]]
2219 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2220 criteria = "safe-to-deploy"
2221 delta = "7.0.1 -> 7.0.2"
2222
2223 [[audits.itertools]]
2224 who = "Mike Hommey <mh+mozilla@glandium.org>"
2225 criteria = "safe-to-deploy"
2226 delta = "0.10.3 -> 0.10.5"
2227
2228 [[audits.itoa]]
2229 who = "Mike Hommey <mh+mozilla@glandium.org>"
2230 criteria = "safe-to-deploy"
2231 delta = "1.0.2 -> 1.0.3"
2232
2233 [[audits.itoa]]
2234 who = "Mike Hommey <mh+mozilla@glandium.org>"
2235 criteria = "safe-to-deploy"
2236 delta = "1.0.3 -> 1.0.5"
2237
2238 [[audits.jobserver]]
2239 who = "Mike Hommey <mh+mozilla@glandium.org>"
2240 criteria = "safe-to-deploy"
2241 delta = "0.1.24 -> 0.1.25"
2242
2243 [[audits.keccak]]
2244 who = "Simon Friedberger <simon@mozilla.com>"
2245 criteria = "safe-to-deploy"
2246 delta = "0.1.2 -> 0.1.3"
2247
2248 [[audits.khronos-egl]]
2249 who = "Nicolas Silva <nical@fastmail.com>"
2250 criteria = "safe-to-deploy"
2251 delta = "4.1.0 -> 6.0.0"
2252
2253 [[audits.libc]]
2254 who = "Mike Hommey <mh+mozilla@glandium.org>"
2255 criteria = "safe-to-deploy"
2256 delta = "0.2.126 -> 0.2.132"
2257
2258 [[audits.libc]]
2259 who = "Mike Hommey <mh+mozilla@glandium.org>"
2260 criteria = "safe-to-deploy"
2261 delta = "0.2.132 -> 0.2.138"
2262
2263 [[audits.libc]]
2264 who = "Mike Hommey <mh+mozilla@glandium.org>"
2265 criteria = "safe-to-deploy"
2266 delta = "0.2.138 -> 0.2.139"
2267
2268 [[audits.libc]]
2269 who = "Mike Hommey <mh+mozilla@glandium.org>"
2270 criteria = "safe-to-deploy"
2271 delta = "0.2.147 -> 0.2.148"
2272
2273 [[audits.libloading]]
2274 who = "Mike Hommey <mh+mozilla@glandium.org>"
2275 criteria = "safe-to-deploy"
2276 delta = "0.7.3 -> 0.7.4"
2277
2278 [[audits.libm]]
2279 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2280 criteria = "safe-to-deploy"
2281 version = "0.2.6"
2282 notes = "This crate uses unsafe block, but this doesn't have network and file access. I audited code."
2283
2284 [[audits.libsqlite3-sys]]
2285 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
2286 criteria = "safe-to-deploy"
2287 delta = "0.25.2 -> 0.26.0"
2288
2289 [[audits.libsqlite3-sys]]
2290 who = "Mark Hammond <mhammond@mozilla.com>"
2291 criteria = "safe-to-deploy"
2292 delta = "0.26.0 -> 0.27.0"
2293
2294 [[audits.linked-hash-map]]
2295 who = "Aria Beingessner <a.beingessner@gmail.com>"
2296 criteria = "safe-to-deploy"
2297 version = "0.5.4"
2298 notes = "I own this crate (I am contain-rs) and 0.5.4 passes miri. This code is very old and used by lots of people, so I'm pretty confident in it, even though it's in maintenance-mode and missing some nice-to-have APIs."
2299
2300 [[audits.linked-hash-map]]
2301 who = "Mike Hommey <mh+mozilla@glandium.org>"
2302 criteria = "safe-to-run"
2303 delta = "0.5.4 -> 0.5.6"
2304
2305 [[audits.litemap]]
2306 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2307 criteria = "safe-to-deploy"
2308 version = "0.7.0"
2309 notes = "This crete has no unsafe code, no file acceess and no network access."
2310
2311 [[audits.litemap]]
2312 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
2313 criteria = "safe-to-deploy"
2314 delta = "0.7.0 -> 0.7.2"
2315
2316 [[audits.lmdb-rkv]]
2317 who = "Bobby Holley <bobbyholley@gmail.com>"
2318 criteria = "safe-to-deploy"
2319 version = "0.14.0"
2320 notes = "Victor and Myk developed this crate at Mozilla."
2321
2322 [[audits.lock_api]]
2323 who = "Mike Hommey <mh+mozilla@glandium.org>"
2324 criteria = "safe-to-deploy"
2325 delta = "0.4.7 -> 0.4.9"
2326
2327 [[audits.log]]
2328 who = "Mike Hommey <mh+mozilla@glandium.org>"
2329 criteria = "safe-to-deploy"
2330 version = "0.4.17"
2331
2332 [[audits.mach2]]
2333 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2334 criteria = "safe-to-deploy"
2335 version = "0.4.1"
2336
2337 [[audits.malloc_buf]]
2338 who = "Bobby Holley <bobbyholley@gmail.com>"
2339 criteria = "safe-to-deploy"
2340 version = "0.0.6"
2341 notes = """
2342 Very small crate for managing malloc-ed buffers, primarily for use in the objc crate.
2343 There is an edge-case condition that passes slice::from_raw_parts(0x1, 0) which I'm
2344 not entirely certain is technically sound, but in either case I am reasonably confident
2345 it's not exploitable.
2346 """
2347
2348 [[audits.malloc_size_of_derive]]
2349 who = "Bobby Holley <bobbyholley@gmail.com>"
2350 criteria = "safe-to-deploy"
2351 version = "0.1.2"
2352 notes = """
2353 This was originally servo code which I put on crates.io some years ago but didn't
2354 examine at the time, so I examined it now. I didn't perform a full logic review
2355 but convinced myself that any generated code will be entirely safe to deploy.
2356 """
2357
2358 [[audits.matches]]
2359 who = "Bobby Holley <bobbyholley@gmail.com>"
2360 criteria = "safe-to-deploy"
2361 version = "0.1.9"
2362 notes = "This is a trivial crate."
2363
2364 [[audits.matches]]
2365 who = "Mike Hommey <mh+mozilla@glandium.org>"
2366 criteria = "safe-to-deploy"
2367 delta = "0.1.9 -> 0.1.10"
2368
2369 [[audits.md-5]]
2370 who = "Dana Keeler <dkeeler@mozilla.com>"
2371 criteria = "safe-to-deploy"
2372 version = "0.10.5"
2373
2374 [[audits.memmap2]]
2375 who = "Mike Hommey <mh+mozilla@glandium.org>"
2376 criteria = "safe-to-deploy"
2377 delta = "0.5.4 -> 0.5.7"
2378
2379 [[audits.memmap2]]
2380 who = "Mike Hommey <mh+mozilla@glandium.org>"
2381 criteria = "safe-to-deploy"
2382 delta = "0.5.7 -> 0.5.8"
2383
2384 [[audits.memmap2]]
2385 who = "Mike Hommey <mh+mozilla@glandium.org>"
2386 criteria = "safe-to-deploy"
2387 delta = "0.5.8 -> 0.5.9"
2388
2389 [[audits.memmap2]]
2390 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2391 criteria = "safe-to-deploy"
2392 delta = "0.5.9 -> 0.8.0"
2393
2394 [[audits.memoffset]]
2395 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2396 criteria = "safe-to-deploy"
2397 delta = "0.6.5 -> 0.7.1"
2398
2399 [[audits.memoffset]]
2400 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2401 criteria = "safe-to-deploy"
2402 delta = "0.8.0 -> 0.9.0"
2403
2404 [[audits.metal]]
2405 who = "Jim Blandy <jimb@red-bean.com>"
2406 criteria = "safe-to-deploy"
2407 version = "0.23.1"
2408 notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer."
2409
2410 [[audits.metal]]
2411 who = "Jim Blandy <jimb@red-bean.com>"
2412 criteria = "safe-to-deploy"
2413 delta = "0.23.1 -> 0.24.0"
2414 notes = "This audit treats Dzmitry Malyshau (kvark) as a trusted reviewer."
2415
2416 [[audits.metal]]
2417 who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
2418 criteria = "safe-to-deploy"
2419 delta = "0.24.0 -> 0.25.0"
2420
2421 [[audits.metal]]
2422 who = "Erich Gubler <egubler@mozilla.com>"
2423 criteria = "safe-to-deploy"
2424 delta = "0.25.0 -> 0.26.0"
2425
2426 [[audits.metal]]
2427 who = "Nicolas Silva <nical@fastmail.com>, Jim Blandy <jimb@red-bean.com>"
2428 criteria = "safe-to-deploy"
2429 delta = "0.26.0 -> 0.27.0"
2430
2431 [[audits.midir]]
2432 who = "Bobby Holley <bobbyholley@gmail.com>"
2433 criteria = "safe-to-deploy"
2434 delta = "0.7.0 -> 0.7.0@git:519e651241e867af3391db08f9ae6400bc023e18"
2435
2436 [[audits.minidump-common]]
2437 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2438 criteria = "safe-to-deploy"
2439 version = "0.15.2"
2440 notes = "The code in this crate was written or reviewed by Mozilla employees."
2441
2442 [[audits.minidump-common]]
2443 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2444 criteria = "safe-to-deploy"
2445 delta = "0.15.2 -> 0.17.0"
2446
2447 [[audits.minidump-common]]
2448 who = "Mike Hommey <mh+mozilla@glandium.org>"
2449 criteria = "safe-to-deploy"
2450 delta = "0.17.0 -> 0.17.0@git:87a29fba5e19cfae5ebf73a57ba31504a3872545"
2451
2452 [[audits.minidump-common]]
2453 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2454 criteria = "safe-to-deploy"
2455 delta = "0.17.0 -> 0.19.1"
2456 notes = "All the changes have been authored or reviewed by Mozilla employees"
2457
2458 [[audits.minidump-common]]
2459 who = "Mike Hommey <mh+mozilla@glandium.org>"
2460 criteria = "safe-to-deploy"
2461 delta = "0.17.0@git:87a29fba5e19cfae5ebf73a57ba31504a3872545 -> 0.17.0@git:6ae42a7f992e8a88ebee661bc77bcedb95cd671f"
2462
2463 [[audits.minidump-writer]]
2464 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2465 criteria = "safe-to-deploy"
2466 version = "0.7.0"
2467 notes = "The code in this crate was written or reviewed by Mozilla employees, the crate it evolved from was written specifically for gecko."
2468
2469 [[audits.minidump-writer]]
2470 who = "Alex Franchuk <afranchuk@mozilla.com>"
2471 criteria = "safe-to-deploy"
2472 delta = "0.7.0 -> 0.8.0"
2473 notes = "The code in this crate was written or reviewed by Mozilla employees, the crate it evolved from was written specifically for gecko."
2474
2475 [[audits.minidump-writer]]
2476 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2477 criteria = "safe-to-deploy"
2478 delta = "0.8.0 -> 0.8.1"
2479
2480 [[audits.minidump-writer]]
2481 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2482 criteria = "safe-to-deploy"
2483 delta = "0.8.1 -> 0.8.1@git:491eb330e78e310c32927e5cc3bd2350af1e93f8"
2484 notes = "All the changes were written by a Mozilla employee (me)"
2485
2486 [[audits.minidump-writer]]
2487 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2488 criteria = "safe-to-deploy"
2489 delta = "0.8.1 -> 0.8.3"
2490 notes = "All changes were authored or reviewed by Mozilla employees"
2491
2492 [[audits.miniz_oxide]]
2493 who = "Mike Hommey <mh+mozilla@glandium.org>"
2494 criteria = "safe-to-deploy"
2495 delta = "0.5.3 -> 0.6.2"
2496
2497 [[audits.mio]]
2498 who = "Bobby Holley <bobbyholley@gmail.com>"
2499 criteria = "safe-to-run"
2500 delta = "0.6.21 -> 0.6.23"
2501
2502 [[audits.mio]]
2503 who = "Mike Hommey <mh+mozilla@glandium.org>"
2504 criteria = "safe-to-deploy"
2505 delta = "0.8.0 -> 0.8.6"
2506
2507 [[audits.moz_cbor]]
2508 who = "Bobby Holley <bobbyholley@gmail.com>"
2509 criteria = "safe-to-deploy"
2510 version = "0.1.2"
2511 notes = "Developed by Mozilla staff."
2512
2513 [[audits.naga]]
2514 who = "Dzmitry Malyshau <kvark@fastmail.com>"
2515 criteria = "safe-to-deploy"
2516 version = "0.8.0"
2517 notes = """
2518 This crate, up through the indicated version, was written or reviewed
2519 by Dzmitry Malyshau while he was a Mozilla employee. Dzmitry left
2520 Mozilla at the beginning of February 2022. This audit statement was
2521 collected by Jim Blandy, a Mozilla employee, over email in July 2022:
2522 Dzmitry was shown, and agreed to, the 'safe-to-deploy' text.
2523 """
2524
2525 [[audits.naga]]
2526 who = "Jim Blandy <jimb@red-bean.com>"
2527 criteria = "safe-to-deploy"
2528 delta = "0.8.0 -> 0.9.0"
2529
2530 [[audits.naga]]
2531 who = "Jim Blandy <jimb@red-bean.com>"
2532 criteria = "safe-to-deploy"
2533 delta = "0.9.0 -> 0.10.0"
2534
2535 [[audits.naga]]
2536 who = "Nicolas Silva <nical@fastmail.com>"
2537 criteria = "safe-to-deploy"
2538 delta = "0.10.0 -> 0.11.0"
2539
2540 [[audits.naga]]
2541 who = "Nicolas Silva <nical@fastmail.com>"
2542 criteria = "safe-to-deploy"
2543 delta = "0.11.0 -> 0.12.0"
2544
2545 [[audits.naga]]
2546 who = "Nicolas Silva <nical@fastmail.com>"
2547 criteria = "safe-to-deploy"
2548 delta = "0.12.0 -> 0.13.0"
2549
2550 [[audits.naga]]
2551 who = "Nicolas Silva <nical@fastmail.com>"
2552 criteria = "safe-to-deploy"
2553 delta = "0.13.0 -> 0.14.0"
2554
2555 [[audits.naga]]
2556 who = [
2557     "Jim Blandy <jimb@red-bean.com>",
2558     "Nicolas Silva <nical@fastmail.com>",
2559     "Teodor Tanasoaia <ttanasoaia@mozilla.com>",
2560 ]
2561 criteria = "safe-to-deploy"
2562 delta = "0.14.0 -> 0.14.2@git:c6eea50b04127abe2340b93141123312baf5414b"
2563 importable = false
2564
2565 [[audits.net2]]
2566 who = "Mike Hommey <mh+mozilla@glandium.org>"
2567 criteria = "safe-to-run"
2568 delta = "0.2.37 -> 0.2.38"
2569
2570 [[audits.new_debug_unreachable]]
2571 who = "Bobby Holley <bobbyholley@gmail.com>"
2572 criteria = "safe-to-deploy"
2573 version = "1.0.4"
2574 notes = "This is a trivial crate."
2575
2576 [[audits.nix]]
2577 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2578 criteria = "safe-to-deploy"
2579 delta = "0.15.0 -> 0.25.0"
2580 notes = "Plenty of new bindings but also several important bug fixes (including buffer overflows). New unsafe sections are restricted to wrappers and are no more dangerous than calling the C functions."
2581
2582 [[audits.nix]]
2583 who = "Mike Hommey <mh+mozilla@glandium.org>"
2584 criteria = "safe-to-deploy"
2585 delta = "0.25.0 -> 0.25.1"
2586
2587 [[audits.nix]]
2588 who = "Mike Hommey <mh+mozilla@glandium.org>"
2589 criteria = "safe-to-deploy"
2590 delta = "0.25.1 -> 0.26.2"
2591
2592 [[audits.nix]]
2593 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2594 criteria = "safe-to-deploy"
2595 delta = "0.26.2 -> 0.27.1"
2596
2597 [[audits.nom]]
2598 who = "Mike Hommey <mh+mozilla@glandium.org>"
2599 criteria = "safe-to-deploy"
2600 delta = "7.1.1 -> 7.1.3"
2601
2602 [[audits.nss-gk-api]]
2603 who = "John M. Schanck <jschanck@mozilla.com>"
2604 criteria = "safe-to-deploy"
2605 version = "0.2.1"
2606 notes = "Maintained by the CryptoEng team at Mozilla."
2607
2608 [[audits.ntapi]]
2609 who = "Mike Hommey <mh+mozilla@glandium.org>"
2610 criteria = "safe-to-deploy"
2611 delta = "0.3.7 -> 0.4.0"
2612
2613 [[audits.num]]
2614 who = "Josh Stone <jistone@redhat.com>"
2615 criteria = "safe-to-deploy"
2616 version = "0.4.0"
2617 notes = "All code written or reviewed by Josh Stone."
2618
2619 [[audits.num-bigint]]
2620 who = "Josh Stone <jistone@redhat.com>"
2621 criteria = "safe-to-deploy"
2622 version = "0.2.6"
2623 notes = "All code written or reviewed by Josh Stone."
2624
2625 [[audits.num-bigint]]
2626 who = "Josh Stone <jistone@redhat.com>"
2627 criteria = "safe-to-deploy"
2628 version = "0.4.3"
2629 notes = "All code written or reviewed by Josh Stone."
2630
2631 [[audits.num-complex]]
2632 who = "Josh Stone <jistone@redhat.com>"
2633 criteria = "safe-to-deploy"
2634 version = "0.4.2"
2635 notes = "All code written or reviewed by Josh Stone."
2636
2637 [[audits.num-derive]]
2638 who = "Josh Stone <jistone@redhat.com>"
2639 criteria = "safe-to-deploy"
2640 version = "0.3.3"
2641 notes = "All code written or reviewed by Josh Stone."
2642
2643 [[audits.num-derive]]
2644 who = "Mike Hommey <mh+mozilla@glandium.org>"
2645 criteria = "safe-to-deploy"
2646 delta = "0.3.3 -> 0.4.0"
2647
2648 [[audits.num-integer]]
2649 who = "Josh Stone <jistone@redhat.com>"
2650 criteria = "safe-to-deploy"
2651 version = "0.1.45"
2652 notes = "All code written or reviewed by Josh Stone."
2653
2654 [[audits.num-iter]]
2655 who = "Josh Stone <jistone@redhat.com>"
2656 criteria = "safe-to-deploy"
2657 version = "0.1.43"
2658 notes = "All code written or reviewed by Josh Stone."
2659
2660 [[audits.num-macros]]
2661 who = "Josh Stone <jistone@redhat.com>"
2662 criteria = "safe-to-deploy"
2663 version = "0.1.40"
2664 notes = "All code written or reviewed by Josh Stone."
2665
2666 [[audits.num-rational]]
2667 who = "Josh Stone <jistone@redhat.com>"
2668 criteria = "safe-to-deploy"
2669 version = "0.4.1"
2670 notes = "All code written or reviewed by Josh Stone."
2671
2672 [[audits.num-traits]]
2673 who = "Josh Stone <jistone@redhat.com>"
2674 criteria = "safe-to-deploy"
2675 version = "0.2.15"
2676 notes = "All code written or reviewed by Josh Stone."
2677
2678 [[audits.num_cpus]]
2679 who = "Mike Hommey <mh+mozilla@glandium.org>"
2680 criteria = "safe-to-deploy"
2681 delta = "1.13.1 -> 1.14.0"
2682
2683 [[audits.num_cpus]]
2684 who = "Mike Hommey <mh+mozilla@glandium.org>"
2685 criteria = "safe-to-deploy"
2686 delta = "1.14.0 -> 1.15.0"
2687
2688 [[audits.object]]
2689 who = "Mike Hommey <mh+mozilla@glandium.org>"
2690 criteria = "safe-to-deploy"
2691 delta = "0.28.4 -> 0.30.0"
2692
2693 [[audits.object]]
2694 who = "Mike Hommey <mh+mozilla@glandium.org>"
2695 criteria = "safe-to-deploy"
2696 delta = "0.30.0 -> 0.30.3"
2697
2698 [[audits.once_cell]]
2699 who = "Mike Hommey <mh+mozilla@glandium.org>"
2700 criteria = "safe-to-deploy"
2701 delta = "1.12.0 -> 1.13.1"
2702
2703 [[audits.once_cell]]
2704 who = "Mike Hommey <mh+mozilla@glandium.org>"
2705 criteria = "safe-to-deploy"
2706 delta = "1.13.1 -> 1.16.0"
2707
2708 [[audits.once_cell]]
2709 who = "Mike Hommey <mh+mozilla@glandium.org>"
2710 criteria = "safe-to-deploy"
2711 delta = "1.16.0 -> 1.17.1"
2712
2713 [[audits.oneshot]]
2714 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
2715 criteria = "safe-to-deploy"
2716 version = "0.1.5"
2717 notes = "Small crate, reviewed by bendk.  There is a decent amount of unsafe code, but it's well tested and the crate has been well-used over the years."
2718
2719 [[audits.oneshot]]
2720 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
2721 criteria = "safe-to-deploy"
2722 version = "0.1.5@git:1f3c657c8073aec4f0b6ebac7be33b4851644745"
2723 notes = """
2724 Small crate, reviewed by bendk.  There is a decent amount of unsafe code, but it's well tested and the crate has been well-used over the years.
2725
2726 The git branch is my fork of the official code that removes the `loom` target to avoid pulling in that crate and its dependencies into moz-central.
2727 This doesn't change any of the functionality -- the `loom` target is only used for testing.
2728 """
2729
2730 [[audits.oneshot-uniffi]]
2731 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
2732 criteria = "safe-to-deploy"
2733 version = "0.1.5"
2734 notes = "This is the essentially same code as `oneshot version 0.1.5` which has already been audited.  The only difference is that it won't pull in `loom` and related dependencies when `mach vendor rust` is run."
2735
2736 [[audits.ordered-float]]
2737 who = "Mike Hommey <mh+mozilla@glandium.org>"
2738 criteria = "safe-to-deploy"
2739 delta = "3.0.0 -> 3.4.0"
2740
2741 [[audits.origin-trial-token]]
2742 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
2743 criteria = "safe-to-deploy"
2744 version = "0.1.1"
2745 notes = """
2746 I'm the author of the crate. The only unsafe code is a view over a byte array
2747 which is properly validated.
2748
2749 Cryptography shenanigans are delegated to the caller so there's no possible
2750 unsoundness there.
2751 """
2752
2753 [[audits.os_str_bytes]]
2754 who = "Mike Hommey <mh+mozilla@glandium.org>"
2755 criteria = "safe-to-deploy"
2756 delta = "6.1.0 -> 6.3.0"
2757
2758 [[audits.os_str_bytes]]
2759 who = "Mike Hommey <mh+mozilla@glandium.org>"
2760 criteria = "safe-to-deploy"
2761 delta = "6.3.0 -> 6.4.1"
2762
2763 [[audits.oxilangtag]]
2764 who = "Jonathan Kew <jkew@mozilla.com>"
2765 criteria = "safe-to-deploy"
2766 version = "0.1.3"
2767 notes = """
2768 I have reviewed all the code in this (small) crate.
2769 There is no unsafe code present.
2770 """
2771
2772 [[audits.packed_simd]]
2773 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
2774 criteria = "safe-to-deploy"
2775 delta = "0.3.8 -> 0.3.9"
2776 notes = "The update from 0.3.8 to 0.3.9 makes mechanical changes to accommodate renaming, compiler updates, and CI service updates."
2777
2778 [[audits.packed_simd]]
2779 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
2780 criteria = "safe-to-deploy"
2781 delta = "0.3.9 -> 0.3.9@git:e588ceb568878e1a3156ea9ce551d5b63ef0cdc4"
2782 notes = "The patch on top of crates.io version 0.3.9 merely deletes code for a feature that Firefox does not use."
2783
2784 [[audits.packed_simd_2]]
2785 who = "Mike Hommey <mh+mozilla@glandium.org>"
2786 criteria = "safe-to-deploy"
2787 delta = "0.3.7 -> 0.3.8"
2788
2789 [[audits.packed_simd_2]]
2790 who = "Bobby Holley <bobbyholley@gmail.com>"
2791 criteria = "safe-to-deploy"
2792 delta = "0.3.8 -> 0.3.8@git:412f9a0aa556611de021bde89dee8fefe6e0fbbd"
2793
2794 [[audits.parking_lot_core]]
2795 who = "Mike Hommey <mh+mozilla@glandium.org>"
2796 criteria = "safe-to-deploy"
2797 delta = "0.8.5 -> 0.8.6"
2798
2799 [[audits.paste]]
2800 who = "Mike Hommey <mh+mozilla@glandium.org>"
2801 criteria = "safe-to-deploy"
2802 delta = "1.0.7 -> 1.0.8"
2803
2804 [[audits.paste]]
2805 who = "Mike Hommey <mh+mozilla@glandium.org>"
2806 criteria = "safe-to-deploy"
2807 delta = "1.0.8 -> 1.0.11"
2808
2809 [[audits.peeking_take_while]]
2810 who = "Bobby Holley <bobbyholley@gmail.com>"
2811 criteria = "safe-to-deploy"
2812 delta = "1.0.0 -> 0.1.2"
2813 notes = "Small refactor of some simple iterator logic, no unsafe code or capabilities."
2814
2815 [[audits.percent-encoding]]
2816 who = "Valentin Gosu <valentin.gosu@gmail.com>"
2817 criteria = "safe-to-deploy"
2818 delta = "2.2.0 -> 2.3.0"
2819
2820 [[audits.percent-encoding]]
2821 who = "Valentin Gosu <valentin.gosu@gmail.com>"
2822 criteria = "safe-to-deploy"
2823 delta = "2.3.0 -> 2.3.1"
2824
2825 [[audits.phf]]
2826 who = "Mike Hommey <mh+mozilla@glandium.org>"
2827 criteria = "safe-to-deploy"
2828 delta = "0.10.1 -> 0.11.2"
2829
2830 [[audits.phf_codegen]]
2831 who = "Mike Hommey <mh+mozilla@glandium.org>"
2832 criteria = "safe-to-deploy"
2833 delta = "0.10.0 -> 0.11.2"
2834
2835 [[audits.phf_generator]]
2836 who = "Mike Hommey <mh+mozilla@glandium.org>"
2837 criteria = "safe-to-deploy"
2838 delta = "0.10.0 -> 0.11.2"
2839
2840 [[audits.phf_macros]]
2841 who = "Mike Hommey <mh+mozilla@glandium.org>"
2842 criteria = "safe-to-deploy"
2843 delta = "0.10.0 -> 0.11.2"
2844
2845 [[audits.phf_shared]]
2846 who = "Mike Hommey <mh+mozilla@glandium.org>"
2847 criteria = "safe-to-deploy"
2848 delta = "0.10.0 -> 0.11.2"
2849
2850 [[audits.pin-project]]
2851 who = "Mike Hommey <mh+mozilla@glandium.org>"
2852 criteria = "safe-to-run"
2853 delta = "1.0.10 -> 1.0.12"
2854
2855 [[audits.pin-project]]
2856 who = "Mike Hommey <mh+mozilla@glandium.org>"
2857 criteria = "safe-to-run"
2858 delta = "1.0.12 -> 1.1.0"
2859
2860 [[audits.pin-project-internal]]
2861 who = "Mike Hommey <mh+mozilla@glandium.org>"
2862 criteria = "safe-to-run"
2863 delta = "1.0.10 -> 1.0.12"
2864
2865 [[audits.pin-project-internal]]
2866 who = "Mike Hommey <mh+mozilla@glandium.org>"
2867 criteria = "safe-to-run"
2868 delta = "1.0.12 -> 1.1.0"
2869
2870 [[audits.pkcs11-bindings]]
2871 who = "Dana Keeler <dkeeler@mozilla.com>"
2872 criteria = "safe-to-deploy"
2873 version = "0.1.0"
2874 notes = """
2875 This crate consists of declarations of types and constants that are
2876 auto-generated by running bindgen on the PKCS#11 specification headers. Other
2877 than the tests generated by bindgen, it consists of no runnable code.
2878 """
2879
2880 [[audits.pkcs11-bindings]]
2881 who = "John M. Schanck <jmschanck@gmail.com>"
2882 criteria = "safe-to-deploy"
2883 version = "0.1.1"
2884
2885 [[audits.pkcs11-bindings]]
2886 who = "Mike Hommey <mh+mozilla@glandium.org>"
2887 criteria = "safe-to-deploy"
2888 delta = "0.1.1 -> 0.1.4"
2889
2890 [[audits.pkcs11-bindings]]
2891 who = "Mike Hommey <mh+mozilla@glandium.org>"
2892 criteria = "safe-to-deploy"
2893 delta = "0.1.4 -> 0.1.5"
2894
2895 [[audits.pkg-config]]
2896 who = "Mike Hommey <mh+mozilla@glandium.org>"
2897 criteria = "safe-to-deploy"
2898 delta = "0.3.25 -> 0.3.26"
2899
2900 [[audits.plane-split]]
2901 who = "Nicolas Silva <nical@fastmail.com>"
2902 criteria = "safe-to-deploy"
2903 version = "0.18.0"
2904 notes = "Mozilla-developed package, no unsafe code, no access to file system, network or other far reaching APIs."
2905
2906 [[audits.ppv-lite86]]
2907 who = "Mike Hommey <mh+mozilla@glandium.org>"
2908 criteria = "safe-to-deploy"
2909 delta = "0.2.16 -> 0.2.17"
2910
2911 [[audits.precomputed-hash]]
2912 who = "Bobby Holley <bobbyholley@gmail.com>"
2913 criteria = "safe-to-deploy"
2914 version = "0.1.1"
2915 notes = "This is a trivial crate."
2916
2917 [[audits.prio]]
2918 who = "Simon Friedberger <simon@mozilla.com>"
2919 criteria = "safe-to-deploy"
2920 version = "0.8.4"
2921 notes = "The crate does not use any unsafe code or ambient capabilities and thus meets the criteria for safe-to-deploy. The cryptography itself should be considered experimental at this phase and is currently undergoing a thorough audit organized by Cloudflare."
2922
2923 [[audits.prio]]
2924 who = "Simon Friedberger <simon@mozilla.com>"
2925 criteria = "safe-to-deploy"
2926 version = "0.9.1"
2927
2928 [[audits.proc-macro-hack]]
2929 who = "Mike Hommey <mh+mozilla@glandium.org>"
2930 criteria = "safe-to-deploy"
2931 delta = "0.5.19 -> 0.5.20+deprecated"
2932
2933 [[audits.proc-macro2]]
2934 who = "Nika Layzell <nika@thelayzells.com>"
2935 criteria = "safe-to-deploy"
2936 version = "1.0.39"
2937 notes = """
2938 `proc-macro2` acts as either a thin(-ish) wrapper around the std-provided
2939 `proc_macro` crate, or as a fallback implementation of the crate, depending on
2940 where it is used.
2941
2942 If using this crate on older versions of rustc (1.56 and earlier), it will
2943 temporarily replace the panic handler while initializing in order to detect if
2944 it is running within a `proc_macro`, which could lead to surprising behaviour.
2945 This should not be an issue for more recent compiler versions, which support
2946 `proc_macro::is_available()`.
2947
2948 The `proc-macro2` crate's fallback behaviour is not identical to the complex
2949 behaviour of the rustc compiler (e.g. it does not perform unicode normalization
2950 for identifiers), however it behaves well enough for its intended use-case
2951 (tests and scripts processing rust code).
2952
2953 `proc-macro2` does not use unsafe code, however exposes one `unsafe` API to
2954 allow bypassing checks in the fallback implementation when constructing
2955 `Literal` using `from_str_unchecked`. This was intended to only be used by the
2956 `quote!` macro, however it has been removed
2957 (https://github.com/dtolnay/quote/commit/f621fe64a8a501cae8e95ebd6848e637bbc79078),
2958 and is likely completely unused. Even when used, this API shouldn't be able to
2959 cause unsoundness.
2960 """
2961
2962 [[audits.proc-macro2]]
2963 who = "Mike Hommey <mh+mozilla@glandium.org>"
2964 criteria = "safe-to-deploy"
2965 delta = "1.0.39 -> 1.0.43"
2966
2967 [[audits.proc-macro2]]
2968 who = "Mike Hommey <mh+mozilla@glandium.org>"
2969 criteria = "safe-to-deploy"
2970 delta = "1.0.43 -> 1.0.49"
2971
2972 [[audits.proc-macro2]]
2973 who = "Mike Hommey <mh+mozilla@glandium.org>"
2974 criteria = "safe-to-deploy"
2975 delta = "1.0.49 -> 1.0.51"
2976
2977 [[audits.procfs-core]]
2978 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2979 criteria = "safe-to-deploy"
2980 version = "0.16.0-RC1"
2981
2982 [[audits.procfs-core]]
2983 who = "Gabriele Svelto <gsvelto@mozilla.com>"
2984 criteria = "safe-to-deploy"
2985 delta = "0.16.0-RC1 -> 0.16.0"
2986
2987 [[audits.profiling]]
2988 who = "Mike Hommey <mh+mozilla@glandium.org>"
2989 criteria = "safe-to-deploy"
2990 delta = "1.0.6 -> 1.0.7"
2991
2992 [[audits.prost]]
2993 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
2994 criteria = "safe-to-deploy"
2995 delta = "0.8.0 -> 0.11.9"
2996 notes = "Mostly internal refactorings. Minimal new unsafe code, but with the invariants explicitly checked in code"
2997
2998 [[audits.prost]]
2999 who = "Drew Willcoxon <adw@mozilla.com>"
3000 criteria = "safe-to-deploy"
3001 delta = "0.11.9 -> 0.12.1"
3002
3003 [[audits.prost-derive]]
3004 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3005 criteria = "safe-to-deploy"
3006 delta = "0.8.0 -> 0.11.9"
3007 notes = "Documentation and internal refactoring changes only"
3008
3009 [[audits.prost-derive]]
3010 who = "Mike Hommey <mh+mozilla@glandium.org>"
3011 criteria = "safe-to-deploy"
3012 delta = "0.11.9 -> 0.11.9@git:95964e9d33df3c2a9c3f14285e262867cab6f96b"
3013 notes = "Changes against 0.11.9 are mine."
3014
3015 [[audits.prost-derive]]
3016 who = "Drew Willcoxon <adw@mozilla.com>"
3017 criteria = "safe-to-deploy"
3018 delta = "0.11.9 -> 0.12.1"
3019
3020 [[audits.qlog]]
3021 who = "Kershaw Chang <kershaw@mozilla.com>"
3022 criteria = "safe-to-deploy"
3023 version = "0.9.0"
3024
3025 [[audits.quote]]
3026 who = "Nika Layzell <nika@thelayzells.com>"
3027 criteria = "safe-to-deploy"
3028 version = "1.0.18"
3029 notes = """
3030 `quote` is a utility crate used by proc-macros to generate TokenStreams
3031 conveniently from source code. The bulk of the logic is some complex
3032 interlocking `macro_rules!` macros which are used to parse and build the
3033 `TokenStream` within the proc-macro.
3034
3035 This crate contains no unsafe code, and the internal logic, while difficult to
3036 read, is generally straightforward. I have audited the the quote macros, ident
3037 formatter, and runtime logic.
3038 """
3039
3040 [[audits.quote]]
3041 who = "Mike Hommey <mh+mozilla@glandium.org>"
3042 criteria = "safe-to-deploy"
3043 delta = "1.0.18 -> 1.0.21"
3044
3045 [[audits.quote]]
3046 who = "Mike Hommey <mh+mozilla@glandium.org>"
3047 criteria = "safe-to-deploy"
3048 delta = "1.0.21 -> 1.0.23"
3049
3050 [[audits.radium]]
3051 who = "Nika Layzell <nika@thelayzells.com>"
3052 criteria = "safe-to-deploy"
3053 version = "0.5.3"
3054 notes = """
3055 I am no longer the primary maintainer of `radium`, however I have audited the
3056 code to ensure it is still correct. The implementation contains no `unsafe`
3057 logic, and will not abstract away `Sync` trait bounds.
3058
3059 The core logic is very simple, and acts as an abstraction trait for `Cell<T>`
3060 and `AtomicT`.
3061 """
3062
3063 [[audits.rand_core]]
3064 who = "Mike Hommey <mh+mozilla@glandium.org>"
3065 criteria = "safe-to-deploy"
3066 delta = "0.6.3 -> 0.6.4"
3067
3068 [[audits.range-alloc]]
3069 who = "Bobby Holley <bobbyholley@gmail.com>"
3070 criteria = "safe-to-deploy"
3071 version = "0.1.2"
3072 notes = "Dzmitry authored this crate while he was staff at Mozilla."
3073
3074 [[audits.range-alloc]]
3075 who = "Mike Hommey <mh+mozilla@glandium.org>"
3076 criteria = "safe-to-deploy"
3077 delta = "0.1.2 -> 0.1.3"
3078
3079 [[audits.range-map]]
3080 who = "Gabriele Svelto <gsvelto@mozilla.com>"
3081 criteria = "safe-to-deploy"
3082 version = "0.2.0"
3083
3084 [[audits.raw-window-handle]]
3085 who = "Jim Blandy <jimb@red-bean.com>"
3086 criteria = "safe-to-deploy"
3087 version = "0.5.0"
3088 notes = "I looked through all the sources of the v0.5.0 crate."
3089
3090 [[audits.raw-window-handle]]
3091 who = "Mike Hommey <mh+mozilla@glandium.org>"
3092 criteria = "safe-to-deploy"
3093 delta = "0.5.0 -> 0.5.2"
3094
3095 [[audits.raw-window-handle]]
3096 who = "Nicolas Silva <nical@fastmail.com>"
3097 criteria = "safe-to-deploy"
3098 delta = "0.5.2 -> 0.6.0"
3099
3100 [[audits.rayon]]
3101 who = "Josh Stone <jistone@redhat.com>"
3102 criteria = "safe-to-deploy"
3103 version = "1.5.3"
3104 notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
3105
3106 [[audits.rayon]]
3107 who = "Mike Hommey <mh+mozilla@glandium.org>"
3108 criteria = "safe-to-deploy"
3109 delta = "1.5.3 -> 1.6.1"
3110
3111 [[audits.rayon-core]]
3112 who = "Josh Stone <jistone@redhat.com>"
3113 criteria = "safe-to-deploy"
3114 version = "1.9.3"
3115 notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
3116
3117 [[audits.rayon-core]]
3118 who = "Mike Hommey <mh+mozilla@glandium.org>"
3119 criteria = "safe-to-deploy"
3120 delta = "1.9.3 -> 1.10.1"
3121
3122 [[audits.rayon-core]]
3123 who = "Mike Hommey <mh+mozilla@glandium.org>"
3124 criteria = "safe-to-deploy"
3125 delta = "1.10.1 -> 1.10.2"
3126
3127 [[audits.redox_syscall]]
3128 who = "Mike Hommey <mh+mozilla@glandium.org>"
3129 criteria = "safe-to-deploy"
3130 delta = "0.2.13 -> 0.2.16"
3131
3132 [[audits.regex]]
3133 who = "Mike Hommey <mh+mozilla@glandium.org>"
3134 criteria = "safe-to-deploy"
3135 delta = "1.5.6 -> 1.6.0"
3136
3137 [[audits.regex]]
3138 who = "Mike Hommey <mh+mozilla@glandium.org>"
3139 criteria = "safe-to-deploy"
3140 delta = "1.6.0 -> 1.7.0"
3141
3142 [[audits.regex]]
3143 who = "Mike Hommey <mh+mozilla@glandium.org>"
3144 criteria = "safe-to-deploy"
3145 delta = "1.7.0 -> 1.7.1"
3146
3147 [[audits.regex-syntax]]
3148 who = "Mike Hommey <mh+mozilla@glandium.org>"
3149 criteria = "safe-to-deploy"
3150 delta = "0.6.26 -> 0.6.27"
3151
3152 [[audits.regex-syntax]]
3153 who = "Mike Hommey <mh+mozilla@glandium.org>"
3154 criteria = "safe-to-deploy"
3155 delta = "0.6.27 -> 0.6.28"
3156
3157 [[audits.rkv]]
3158 who = "Chris H-C <chutten@mozilla.com>"
3159 criteria = "safe-to-deploy"
3160 version = "0.18.2"
3161 notes = "Maintained by Jan-Erik and :krosylight."
3162
3163 [[audits.rkv]]
3164 who = "Chris H-C <chutten@mozilla.com>"
3165 criteria = "safe-to-deploy"
3166 version = "0.18.4"
3167
3168 [[audits.ron]]
3169 who = "Mike Hommey <mh+mozilla@glandium.org>"
3170 criteria = "safe-to-deploy"
3171 delta = "0.7.0 -> 0.7.1"
3172
3173 [[audits.ron]]
3174 who = "Jim Blandy <jimb@red-bean.com>"
3175 criteria = "safe-to-deploy"
3176 delta = "0.7.1 -> 0.8.0"
3177
3178 [[audits.ron]]
3179 who = "Mike Hommey <mh+mozilla@glandium.org>"
3180 criteria = "safe-to-deploy"
3181 delta = "0.8.0 -> 0.8.1"
3182
3183 [[audits.rure]]
3184 who = "Nika Layzell <nika@thelayzells.com>"
3185 criteria = "safe-to-deploy"
3186 version = "0.2.2"
3187 notes = """
3188 This is a fairly straightforward FFI wrapper crate for `regex`, maintained by
3189 the `regex` developers in the same repository.
3190
3191 This crate is explicitly designed for FFI use, and should not be used directly
3192 by Rust code. The exported `extern \"C\"` functions are not marked as `unsafe`,
3193 meaning that it is technically incorrect to use them from within Rust code,
3194 however they are reasonable to use from C code.
3195
3196 The unsafe code in this crate heavily depends on the C caller maintaining
3197 invariants, however these invariants are clearly documented in the `rure.h`
3198 file, bundled with the crate.
3199
3200 I have checked the signatures of each function both in C++ and in the Rust to
3201 ensure they match.  In some places, the c `rure.h` header file is missing a
3202 `const` qualifier which could be present given the Rust code, however this will
3203 have no impact on ABI, and is fairly normal for FFI crates.
3204
3205 Panics are handled in all Rust FFI methods, meaning that projects which do not
3206 disable unwinding will still consistently abort (using `libc::abort()`) if a
3207 panic occurs in the Rust code.
3208 """
3209
3210 [[audits.rusqlite]]
3211 who = "Mike Hommey <mh+mozilla@glandium.org>"
3212 criteria = "safe-to-deploy"
3213 delta = "0.27.0 -> 0.28.0"
3214
3215 [[audits.rusqlite]]
3216 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
3217 criteria = "safe-to-deploy"
3218 delta = "0.28.0 -> 0.29.0"
3219
3220 [[audits.rusqlite]]
3221 who = "Mark Hammond <mhammond@mozilla.com>"
3222 criteria = "safe-to-deploy"
3223 delta = "0.29.0 -> 0.30.0"
3224
3225 [[audits.rust_cascade]]
3226 who = "Mike Hommey <mh+mozilla@glandium.org>"
3227 criteria = "safe-to-deploy"
3228 delta = "1.4.0 -> 1.5.0"
3229
3230 [[audits.rust_decimal]]
3231 who = "Mike Hommey <mh+mozilla@glandium.org>"
3232 criteria = "safe-to-deploy"
3233 delta = "1.24.0 -> 1.25.0"
3234
3235 [[audits.rust_decimal]]
3236 who = "Mike Hommey <mh+mozilla@glandium.org>"
3237 criteria = "safe-to-deploy"
3238 delta = "1.25.0 -> 1.26.1"
3239
3240 [[audits.rust_decimal]]
3241 who = "Mike Hommey <mh+mozilla@glandium.org>"
3242 criteria = "safe-to-deploy"
3243 delta = "1.26.1 -> 1.27.0"
3244
3245 [[audits.rust_decimal]]
3246 who = "Mike Hommey <mh+mozilla@glandium.org>"
3247 criteria = "safe-to-deploy"
3248 delta = "1.27.0 -> 1.28.1"
3249
3250 [[audits.rustc-hash]]
3251 who = "Bobby Holley <bobbyholley@gmail.com>"
3252 criteria = "safe-to-deploy"
3253 version = "1.1.0"
3254 notes = "Straightforward crate with no unsafe code, does what it says on the tin."
3255
3256 [[audits.rustc_version]]
3257 who = "Nika Layzell <nika@thelayzells.com>"
3258 criteria = "safe-to-run"
3259 version = "0.4.0"
3260 notes = """
3261 Straightforward crate which runs `$RUSTC -vV` and parses the output into a
3262 machine-interpretable form for build scripts.
3263 """
3264
3265 [[audits.rustversion]]
3266 who = "Bobby Holley <bobbyholley@gmail.com>"
3267 criteria = "safe-to-deploy"
3268 version = "1.0.9"
3269 notes = """
3270 This crate has a build-time component and procedural macro logic, which I looked
3271 at enough to convince myself it wasn't going to do anything dramatically wrong.
3272 I don't think logic bugs in the version parsing etc can realistically introduce
3273 a security vulnerability.
3274 """
3275
3276 [[audits.rustversion]]
3277 who = "Mike Hommey <mh+mozilla@glandium.org>"
3278 criteria = "safe-to-run"
3279 delta = "1.0.9 -> 1.0.11"
3280
3281 [[audits.ryu]]
3282 who = "Mike Hommey <mh+mozilla@glandium.org>"
3283 criteria = "safe-to-deploy"
3284 delta = "1.0.10 -> 1.0.11"
3285
3286 [[audits.ryu]]
3287 who = "Mike Hommey <mh+mozilla@glandium.org>"
3288 criteria = "safe-to-deploy"
3289 delta = "1.0.11 -> 1.0.12"
3290
3291 [[audits.safemem]]
3292 who = "Bobby Holley <bobbyholley@gmail.com>"
3293 criteria = "safe-to-run"
3294 version = "0.3.3"
3295 notes = "I didn't review the allocation code carefully but it's not malicious."
3296
3297 [[audits.scoped-tls]]
3298 who = "Mike Hommey <mh+mozilla@glandium.org>"
3299 criteria = "safe-to-run"
3300 delta = "1.0.0 -> 1.0.1"
3301
3302 [[audits.scroll]]
3303 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3304 criteria = "safe-to-deploy"
3305 delta = "0.10.2 -> 0.11.0"
3306 notes = "Small changes to exposed traits, that look reasonable and have additional buffer boundary checks. No unsafe code touched."
3307
3308 [[audits.scroll_derive]]
3309 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3310 criteria = "safe-to-deploy"
3311 delta = "0.10.5 -> 0.11.0"
3312 notes = "No code changes. Tagged together with its parent crate scroll."
3313
3314 [[audits.scroll_derive]]
3315 who = "Mike Hommey <mh+mozilla@glandium.org>"
3316 criteria = "safe-to-deploy"
3317 delta = "0.11.0 -> 0.11.1"
3318
3319 [[audits.selectors]]
3320 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
3321 criteria = "safe-to-deploy"
3322 version = "0.22.0"
3323 notes = """
3324 This crate is basically developed in-tree. Mozilla employees have either
3325 reviewed or written virtually all of the code.
3326 """
3327
3328 [[audits.semver]]
3329 who = "Mike Hommey <mh+mozilla@glandium.org>"
3330 criteria = "safe-to-deploy"
3331 delta = "1.0.9 -> 1.0.10"
3332
3333 [[audits.semver]]
3334 who = "Mike Hommey <mh+mozilla@glandium.org>"
3335 criteria = "safe-to-deploy"
3336 delta = "1.0.10 -> 1.0.13"
3337
3338 [[audits.semver]]
3339 who = "Mike Hommey <mh+mozilla@glandium.org>"
3340 criteria = "safe-to-deploy"
3341 delta = "1.0.13 -> 1.0.16"
3342
3343 [[audits.semver]]
3344 who = "Bobby Holley <bobbyholley@gmail.com>"
3345 criteria = "safe-to-deploy"
3346 delta = "1.0.17 -> 1.0.16"
3347
3348 [[audits.serde]]
3349 who = "Mike Hommey <mh+mozilla@glandium.org>"
3350 criteria = "safe-to-deploy"
3351 delta = "1.0.137 -> 1.0.143"
3352
3353 [[audits.serde]]
3354 who = "Mike Hommey <mh+mozilla@glandium.org>"
3355 criteria = "safe-to-deploy"
3356 delta = "1.0.143 -> 1.0.144"
3357
3358 [[audits.serde]]
3359 who = "Mike Hommey <mh+mozilla@glandium.org>"
3360 criteria = "safe-to-deploy"
3361 delta = "1.0.144 -> 1.0.151"
3362
3363 [[audits.serde]]
3364 who = "Mike Hommey <mh+mozilla@glandium.org>"
3365 criteria = "safe-to-deploy"
3366 delta = "1.0.151 -> 1.0.152"
3367
3368 [[audits.serde_bytes]]
3369 who = "Mike Hommey <mh+mozilla@glandium.org>"
3370 criteria = "safe-to-deploy"
3371 delta = "0.11.6 -> 0.11.7"
3372
3373 [[audits.serde_bytes]]
3374 who = "Mike Hommey <mh+mozilla@glandium.org>"
3375 criteria = "safe-to-deploy"
3376 delta = "0.11.7 -> 0.11.8"
3377
3378 [[audits.serde_bytes]]
3379 who = "Mike Hommey <mh+mozilla@glandium.org>"
3380 criteria = "safe-to-deploy"
3381 delta = "0.11.8 -> 0.11.9"
3382
3383 [[audits.serde_cbor]]
3384 who = "R. Martinho Fernandes <bugs@rmf.io>"
3385 criteria = "safe-to-deploy"
3386 version = "0.11.1"
3387
3388 [[audits.serde_cbor]]
3389 who = "John M. Schanck <jschanck@mozilla.com>"
3390 criteria = "safe-to-deploy"
3391 delta = "0.11.1 -> 0.11.2"
3392
3393 [[audits.serde_derive]]
3394 who = "Mike Hommey <mh+mozilla@glandium.org>"
3395 criteria = "safe-to-deploy"
3396 delta = "1.0.137 -> 1.0.143"
3397
3398 [[audits.serde_derive]]
3399 who = "Mike Hommey <mh+mozilla@glandium.org>"
3400 criteria = "safe-to-deploy"
3401 delta = "1.0.143 -> 1.0.144"
3402
3403 [[audits.serde_derive]]
3404 who = "Mike Hommey <mh+mozilla@glandium.org>"
3405 criteria = "safe-to-deploy"
3406 delta = "1.0.144 -> 1.0.151"
3407
3408 [[audits.serde_derive]]
3409 who = "Mike Hommey <mh+mozilla@glandium.org>"
3410 criteria = "safe-to-deploy"
3411 delta = "1.0.151 -> 1.0.152"
3412
3413 [[audits.serde_json]]
3414 who = "Mike Hommey <mh+mozilla@glandium.org>"
3415 criteria = "safe-to-deploy"
3416 delta = "1.0.81 -> 1.0.83"
3417
3418 [[audits.serde_json]]
3419 who = "Mike Hommey <mh+mozilla@glandium.org>"
3420 criteria = "safe-to-deploy"
3421 delta = "1.0.83 -> 1.0.85"
3422
3423 [[audits.serde_json]]
3424 who = "Mike Hommey <mh+mozilla@glandium.org>"
3425 criteria = "safe-to-deploy"
3426 delta = "1.0.85 -> 1.0.91"
3427
3428 [[audits.serde_json]]
3429 who = "Mike Hommey <mh+mozilla@glandium.org>"
3430 criteria = "safe-to-deploy"
3431 delta = "1.0.91 -> 1.0.93"
3432
3433 [[audits.serde_path_to_error]]
3434 who = "Ben Dean-Kawamura <bdk@mozilla.com>"
3435 criteria = "safe-to-deploy"
3436 version = "0.1.11"
3437
3438 [[audits.serde_repr]]
3439 who = "Mike Hommey <mh+mozilla@glandium.org>"
3440 criteria = "safe-to-run"
3441 delta = "0.1.8 -> 0.1.9"
3442
3443 [[audits.serde_repr]]
3444 who = "Mike Hommey <mh+mozilla@glandium.org>"
3445 criteria = "safe-to-run"
3446 delta = "0.1.9 -> 0.1.10"
3447
3448 [[audits.serde_with]]
3449 who = "Mike Hommey <mh+mozilla@glandium.org>"
3450 criteria = "safe-to-deploy"
3451 delta = "1.14.0 -> 3.0.0"
3452
3453 [[audits.serde_with_macros]]
3454 who = "Mike Hommey <mh+mozilla@glandium.org>"
3455 criteria = "safe-to-deploy"
3456 delta = "1.5.2 -> 3.0.0"
3457
3458 [[audits.serde_yaml]]
3459 who = "Mike Hommey <mh+mozilla@glandium.org>"
3460 criteria = "safe-to-run"
3461 delta = "0.8.24 -> 0.8.26"
3462
3463 [[audits.servo_arc]]
3464 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
3465 criteria = "safe-to-deploy"
3466 version = "0.1.1"
3467 notes = "Developed in-tree, effectively."
3468
3469 [[audits.sfv]]
3470 who = "Mike Hommey <mh+mozilla@glandium.org>"
3471 criteria = "safe-to-deploy"
3472 delta = "0.9.2 -> 0.9.3"
3473
3474 [[audits.sha1]]
3475 who = "Dana Keeler <dkeeler@mozilla.com>"
3476 criteria = "safe-to-deploy"
3477 version = "0.10.5"
3478
3479 [[audits.sha1]]
3480 who = "Mike Hommey <mh+mozilla@glandium.org>"
3481 criteria = "safe-to-run"
3482 delta = "0.10.0 -> 0.10.5"
3483
3484 [[audits.sha2]]
3485 who = "Mike Hommey <mh+mozilla@glandium.org>"
3486 criteria = "safe-to-deploy"
3487 delta = "0.10.2 -> 0.10.6"
3488
3489 [[audits.sha3]]
3490 who = "Simon Friedberger <simon@mozilla.com>"
3491 criteria = "safe-to-deploy"
3492 delta = "0.10.6 -> 0.10.7"
3493
3494 [[audits.slab]]
3495 who = "Mike Hommey <mh+mozilla@glandium.org>"
3496 criteria = "safe-to-deploy"
3497 delta = "0.4.6 -> 0.4.7"
3498
3499 [[audits.slab]]
3500 who = "Mike Hommey <mh+mozilla@glandium.org>"
3501 criteria = "safe-to-deploy"
3502 delta = "0.4.7 -> 0.4.8"
3503
3504 [[audits.smallbitvec]]
3505 who = "Bobby Holley <bobbyholley@gmail.com>"
3506 criteria = "safe-to-deploy"
3507 version = "2.5.0"
3508 notes = "All code written or reviewed by Mozilla staff."
3509
3510 [[audits.smallbitvec]]
3511 who = "Bobby Holley <bobbyholley@gmail.com>"
3512 criteria = "safe-to-deploy"
3513 delta = "2.5.0 -> 2.5.1"
3514
3515 [[audits.smallvec]]
3516 who = "Mike Hommey <mh+mozilla@glandium.org>"
3517 criteria = "safe-to-deploy"
3518 delta = "1.8.0 -> 1.9.0"
3519
3520 [[audits.smallvec]]
3521 who = "Mike Hommey <mh+mozilla@glandium.org>"
3522 criteria = "safe-to-deploy"
3523 delta = "1.9.0 -> 1.10.0"
3524
3525 [[audits.smart-default]]
3526 who = "Gabriele Svelto <gsvelto@mozilla.com>"
3527 criteria = "safe-to-deploy"
3528 version = "0.6.0"
3529
3530 [[audits.smart-default]]
3531 who = "Mike Hommey <mh+mozilla@glandium.org>"
3532 criteria = "safe-to-deploy"
3533 delta = "0.6.0 -> 0.7.1"
3534
3535 [[audits.socket2]]
3536 who = "Mike Hommey <mh+mozilla@glandium.org>"
3537 criteria = "safe-to-deploy"
3538 delta = "0.4.4 -> 0.4.7"
3539
3540 [[audits.spirv]]
3541 who = "Nicolas Silva <nical@fastmail.com>"
3542 criteria = "safe-to-deploy"
3543 delta = "0.2.0+1.5.4 -> 0.3.0+sdk-1.3.268.0"
3544
3545 [[audits.strck]]
3546 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3547 criteria = "safe-to-deploy"
3548 version = "0.1.2"
3549 notes = "This crate uses unsafe lock to keep invariant. I auditted code. Also, this doesn't have file access and network access."
3550
3551 [[audits.strck_ident]]
3552 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3553 criteria = "safe-to-deploy"
3554 version = "0.1.2"
3555 notes = "This crate doesn't use unsafe block, network access and filesystem access."
3556
3557 [[audits.subtle]]
3558 who = "Simon Friedberger <simon@mozilla.com>"
3559 criteria = "safe-to-deploy"
3560 version = "2.5.0"
3561 notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation."
3562
3563 [[audits.svg_fmt]]
3564 who = "Bobby Holley <bobbyholley@gmail.com>"
3565 criteria = "safe-to-deploy"
3566 version = "0.4.1"
3567 notes = "Simple string processing with no unsafe code or ambient capability usage."
3568
3569 [[audits.syn]]
3570 who = "Mike Hommey <mh+mozilla@glandium.org>"
3571 criteria = "safe-to-deploy"
3572 delta = "1.0.96 -> 1.0.99"
3573
3574 [[audits.syn]]
3575 who = "Mike Hommey <mh+mozilla@glandium.org>"
3576 criteria = "safe-to-deploy"
3577 delta = "1.0.99 -> 1.0.107"
3578
3579 [[audits.synstructure]]
3580 who = "Nika Layzell <nika@thelayzells.com>"
3581 criteria = "safe-to-deploy"
3582 version = "0.12.6"
3583 notes = """
3584 I am the primary author of the `synstructure` crate, and its current
3585 maintainer. The one use of `unsafe` is unnecessary, but documented and
3586 harmless. It will be removed in the next version.
3587 """
3588
3589 [[audits.synstructure]]
3590 who = "Mike Hommey <mh+mozilla@glandium.org>"
3591 criteria = "safe-to-deploy"
3592 delta = "0.12.6 -> 0.13.0"
3593
3594 [[audits.tempfile]]
3595 who = "Mike Hommey <mh+mozilla@glandium.org>"
3596 criteria = "safe-to-deploy"
3597 delta = "3.6.0 -> 3.8.0"
3598
3599 [[audits.termcolor]]
3600 who = "Mike Hommey <mh+mozilla@glandium.org>"
3601 criteria = "safe-to-deploy"
3602 delta = "1.1.3 -> 1.2.0"
3603
3604 [[audits.textwrap]]
3605 who = "Mike Hommey <mh+mozilla@glandium.org>"
3606 criteria = "safe-to-deploy"
3607 delta = "0.15.0 -> 0.15.2"
3608
3609 [[audits.textwrap]]
3610 who = "Mike Hommey <mh+mozilla@glandium.org>"
3611 criteria = "safe-to-deploy"
3612 delta = "0.15.2 -> 0.16.0"
3613
3614 [[audits.thin-vec]]
3615 who = "Aria Beingessner <a.beingessner@gmail.com>"
3616 criteria = "safe-to-deploy"
3617 version = "0.2.5"
3618 notes = "I own this crate, and most of its versions were codeveloped and reviewed by Nika Layzell. This version was not explicitly reviewed by her, but it was specifically a release that made the code pass miri and was reviewed by me. Firefox uses it in the gecko-ffi configuration which is less thoroughly tested and more dangerous but we're reasonably confident in it. The real danger is from C++ code failing to use it correctly in FFI but that's just how FFI is."
3619
3620 [[audits.thin-vec]]
3621 who = "Mike Hommey <mh+mozilla@glandium.org>"
3622 criteria = "safe-to-deploy"
3623 delta = "0.2.5 -> 0.2.7"
3624
3625 [[audits.thin-vec]]
3626 who = "Mike Hommey <mh+mozilla@glandium.org>"
3627 criteria = "safe-to-deploy"
3628 delta = "0.2.7 -> 0.2.12"
3629
3630 [[audits.thiserror]]
3631 who = "Mike Hommey <mh+mozilla@glandium.org>"
3632 criteria = "safe-to-deploy"
3633 delta = "1.0.31 -> 1.0.32"
3634
3635 [[audits.thiserror]]
3636 who = "Mike Hommey <mh+mozilla@glandium.org>"
3637 criteria = "safe-to-deploy"
3638 delta = "1.0.32 -> 1.0.38"
3639
3640 [[audits.thiserror-impl]]
3641 who = "Mike Hommey <mh+mozilla@glandium.org>"
3642 criteria = "safe-to-deploy"
3643 delta = "1.0.31 -> 1.0.32"
3644
3645 [[audits.thiserror-impl]]
3646 who = "Mike Hommey <mh+mozilla@glandium.org>"
3647 criteria = "safe-to-deploy"
3648 delta = "1.0.32 -> 1.0.38"
3649
3650 [[audits.threadbound]]
3651 who = "Mike Hommey <mh+mozilla@glandium.org>"
3652 criteria = "safe-to-deploy"
3653 delta = "0.1.3 -> 0.1.4"
3654
3655 [[audits.threadbound]]
3656 who = "Mike Hommey <mh+mozilla@glandium.org>"
3657 criteria = "safe-to-deploy"
3658 delta = "0.1.4 -> 0.1.5"
3659
3660 [[audits.time]]
3661 who = "Mike Hommey <mh+mozilla@glandium.org>"
3662 criteria = "safe-to-deploy"
3663 delta = "0.1.44 -> 0.1.45"
3664
3665 [[audits.time]]
3666 who = "Kershaw Chang <kershaw@mozilla.com>"
3667 criteria = "safe-to-deploy"
3668 delta = "0.1.45 -> 0.3.17"
3669
3670 [[audits.time]]
3671 who = "Mike Hommey <mh+mozilla@glandium.org>"
3672 criteria = "safe-to-run"
3673 delta = "0.3.9 -> 0.3.17"
3674
3675 [[audits.time]]
3676 who = "Kershaw Chang <kershaw@mozilla.com>"
3677 criteria = "safe-to-deploy"
3678 delta = "0.3.17 -> 0.3.23"
3679
3680 [[audits.time-core]]
3681 who = "Kershaw Chang <kershaw@mozilla.com>"
3682 criteria = "safe-to-deploy"
3683 version = "0.1.0"
3684
3685 [[audits.time-core]]
3686 who = "Mike Hommey <mh+mozilla@glandium.org>"
3687 criteria = "safe-to-run"
3688 version = "0.1.0"
3689
3690 [[audits.time-core]]
3691 who = "Kershaw Chang <kershaw@mozilla.com>"
3692 criteria = "safe-to-deploy"
3693 delta = "0.1.0 -> 0.1.1"
3694
3695 [[audits.time-macros]]
3696 who = "Kershaw Chang <kershaw@mozilla.com>"
3697 criteria = "safe-to-deploy"
3698 version = "0.2.6"
3699
3700 [[audits.time-macros]]
3701 who = "Mike Hommey <mh+mozilla@glandium.org>"
3702 criteria = "safe-to-run"
3703 delta = "0.2.4 -> 0.2.6"
3704
3705 [[audits.time-macros]]
3706 who = "Kershaw Chang <kershaw@mozilla.com>"
3707 criteria = "safe-to-deploy"
3708 delta = "0.2.6 -> 0.2.10"
3709
3710 [[audits.tinystr]]
3711 who = "Zibi Braniecki <zibi@unicode.org>"
3712 criteria = "safe-to-deploy"
3713 version = "0.3.4"
3714
3715 [[audits.tinystr]]
3716 who = "Zibi Braniecki <zibi@unicode.org>"
3717 criteria = "safe-to-deploy"
3718 version = "0.6.0"
3719
3720 [[audits.tinystr]]
3721 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3722 criteria = "safe-to-deploy"
3723 version = "0.7.0"
3724 notes = "One of original auther was Zibi Braniecki who worked at Mozilla and maintained by ICU4X developers (Google and Mozilla). I've vetted the one instance of unsafe code."
3725
3726 [[audits.tinystr]]
3727 who = "Mike Hommey <mh+mozilla@glandium.org>"
3728 criteria = "safe-to-deploy"
3729 delta = "0.7.0 -> 0.7.1"
3730
3731 [[audits.tinystr]]
3732 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3733 criteria = "safe-to-deploy"
3734 delta = "0.7.1 -> 0.7.4"
3735
3736 [[audits.tokio-macros]]
3737 who = "Mike Hommey <mh+mozilla@glandium.org>"
3738 criteria = "safe-to-run"
3739 delta = "1.8.0 -> 1.8.2"
3740
3741 [[audits.tokio-stream]]
3742 who = "Mike Hommey <mh+mozilla@glandium.org>"
3743 criteria = "safe-to-run"
3744 delta = "0.1.9 -> 0.1.11"
3745
3746 [[audits.tokio-stream]]
3747 who = "Mike Hommey <mh+mozilla@glandium.org>"
3748 criteria = "safe-to-run"
3749 delta = "0.1.11 -> 0.1.12"
3750
3751 [[audits.toml]]
3752 who = "Bobby Holley <bobbyholley@gmail.com>"
3753 criteria = "safe-to-deploy"
3754 delta = "0.5.7 -> 0.5.9"
3755
3756 [[audits.toml]]
3757 who = "Mike Hommey <mh+mozilla@glandium.org>"
3758 criteria = "safe-to-deploy"
3759 delta = "0.5.9 -> 0.5.10"
3760
3761 [[audits.toml]]
3762 who = "Mike Hommey <mh+mozilla@glandium.org>"
3763 criteria = "safe-to-deploy"
3764 delta = "0.5.10 -> 0.5.11"
3765
3766 [[audits.topological-sort]]
3767 who = "Bobby Holley <bobbyholley@gmail.com>"
3768 criteria = "safe-to-deploy"
3769 version = "0.1.0"
3770 notes = "Simple algorithm crate with no unsafe code or capability usage."
3771
3772 [[audits.tower-service]]
3773 who = "Mike Hommey <mh+mozilla@glandium.org>"
3774 criteria = "safe-to-run"
3775 delta = "0.3.1 -> 0.3.2"
3776
3777 [[audits.tracing]]
3778 who = "Mike Hommey <mh+mozilla@glandium.org>"
3779 criteria = "safe-to-run"
3780 delta = "0.1.35 -> 0.1.36"
3781
3782 [[audits.tracing]]
3783 who = "Mike Hommey <mh+mozilla@glandium.org>"
3784 criteria = "safe-to-run"
3785 delta = "0.1.36 -> 0.1.37"
3786
3787 [[audits.tracing-attributes]]
3788 who = "Mike Hommey <mh+mozilla@glandium.org>"
3789 criteria = "safe-to-run"
3790 delta = "0.1.21 -> 0.1.22"
3791
3792 [[audits.tracing-attributes]]
3793 who = "Mike Hommey <mh+mozilla@glandium.org>"
3794 criteria = "safe-to-run"
3795 delta = "0.1.22 -> 0.1.23"
3796
3797 [[audits.tracing-attributes]]
3798 who = "Mike Hommey <mh+mozilla@glandium.org>"
3799 criteria = "safe-to-run"
3800 delta = "0.1.23 -> 0.1.24"
3801
3802 [[audits.tracing-core]]
3803 who = "Mike Hommey <mh+mozilla@glandium.org>"
3804 criteria = "safe-to-run"
3805 delta = "0.1.27 -> 0.1.29"
3806
3807 [[audits.tracing-core]]
3808 who = "Mike Hommey <mh+mozilla@glandium.org>"
3809 criteria = "safe-to-run"
3810 delta = "0.1.29 -> 0.1.30"
3811
3812 [[audits.tracy-rs]]
3813 who = "Glenn Watson <git@intuitionlibrary.com>"
3814 criteria = "safe-to-deploy"
3815 version = "0.1.2"
3816
3817 [[audits.try-lock]]
3818 who = "Mike Hommey <mh+mozilla@glandium.org>"
3819 criteria = "safe-to-run"
3820 delta = "0.2.3 -> 0.2.4"
3821
3822 [[audits.typed-arena-nomut]]
3823 who = "Lee Salzman <lsalzman@gmail.com>"
3824 criteria = "safe-to-deploy"
3825 version = "0.1.0"
3826
3827 [[audits.typenum]]
3828 who = "Mike Hommey <mh+mozilla@glandium.org>"
3829 criteria = "safe-to-deploy"
3830 delta = "1.15.0 -> 1.16.0"
3831
3832 [[audits.uluru]]
3833 who = "Emilio Cobos Álvarez <emilio@crisal.io>"
3834 criteria = "safe-to-deploy"
3835 version = "3.0.0"
3836 notes = """
3837 I've reviewed multiple patches in this crate, including the initial
3838 implementation back in the day. It has no unsafe code at all nowadays.
3839 """
3840
3841 [[audits.unic-langid]]
3842 who = "Zibi Braniecki <zibi@unicode.org>"
3843 criteria = "safe-to-deploy"
3844 version = "0.9.0"
3845
3846 [[audits.unic-langid]]
3847 who = "Mike Hommey <mh+mozilla@glandium.org>"
3848 criteria = "safe-to-deploy"
3849 delta = "0.9.0 -> 0.9.1"
3850
3851 [[audits.unic-langid-impl]]
3852 who = "Zibi Braniecki <zibi@unicode.org>"
3853 criteria = "safe-to-deploy"
3854 version = "0.9.0"
3855
3856 [[audits.unic-langid-impl]]
3857 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3858 criteria = "safe-to-deploy"
3859 delta = "0.9.0 -> 0.9.1"
3860
3861 [[audits.unic-langid-macros]]
3862 who = "Zibi Braniecki <zibi@unicode.org>"
3863 criteria = "safe-to-deploy"
3864 version = "0.9.0"
3865
3866 [[audits.unic-langid-macros]]
3867 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3868 criteria = "safe-to-deploy"
3869 delta = "0.9.0 -> 0.9.1"
3870
3871 [[audits.unic-langid-macros-impl]]
3872 who = "Zibi Braniecki <zibi@unicode.org>"
3873 criteria = "safe-to-deploy"
3874 version = "0.9.0"
3875
3876 [[audits.unic-langid-macros-impl]]
3877 who = "Mike Hommey <mh+mozilla@glandium.org>"
3878 criteria = "safe-to-deploy"
3879 delta = "0.9.0 -> 0.9.1"
3880
3881 [[audits.unicode-bidi]]
3882 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
3883 criteria = "safe-to-deploy"
3884 delta = "0.3.8 -> 0.3.13"
3885
3886 [[audits.unicode-ident]]
3887 who = "Mike Hommey <mh+mozilla@glandium.org>"
3888 criteria = "safe-to-deploy"
3889 delta = "1.0.0 -> 1.0.1"
3890
3891 [[audits.unicode-ident]]
3892 who = "Mike Hommey <mh+mozilla@glandium.org>"
3893 criteria = "safe-to-deploy"
3894 delta = "1.0.1 -> 1.0.3"
3895
3896 [[audits.unicode-ident]]
3897 who = "Mike Hommey <mh+mozilla@glandium.org>"
3898 criteria = "safe-to-deploy"
3899 delta = "1.0.3 -> 1.0.6"
3900
3901 [[audits.unicode-normalization]]
3902 who = "Mike Hommey <mh+mozilla@glandium.org>"
3903 criteria = "safe-to-deploy"
3904 delta = "0.1.19 -> 0.1.20"
3905 notes = "I am the author of most of these changes upstream, and prepared the release myself, at which point I looked at the other changes since 0.1.19."
3906
3907 [[audits.unicode-normalization]]
3908 who = "Mike Hommey <mh+mozilla@glandium.org>"
3909 criteria = "safe-to-deploy"
3910 delta = "0.1.20 -> 0.1.21"
3911
3912 [[audits.unicode-normalization]]
3913 who = "Mike Hommey <mh+mozilla@glandium.org>"
3914 criteria = "safe-to-deploy"
3915 delta = "0.1.21 -> 0.1.22"
3916
3917 [[audits.unicode-segmentation]]
3918 who = "Mike Hommey <mh+mozilla@glandium.org>"
3919 criteria = "safe-to-deploy"
3920 delta = "1.9.0 -> 1.10.0"
3921
3922 [[audits.unicode-width]]
3923 who = "Mike Hommey <mh+mozilla@glandium.org>"
3924 criteria = "safe-to-deploy"
3925 delta = "0.1.9 -> 0.1.10"
3926
3927 [[audits.unicode-xid]]
3928 who = "Mike Hommey <mh+mozilla@glandium.org>"
3929 criteria = "safe-to-deploy"
3930 delta = "0.2.3 -> 0.2.4"
3931
3932 [[audits.uniffi]]
3933 who = "Travis Long <tlong@mozilla.com>"
3934 criteria = "safe-to-deploy"
3935 version = "0.19.3"
3936 notes = "Maintained by the Glean and Application Services teams"
3937
3938 [[audits.uniffi]]
3939 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3940 criteria = "safe-to-deploy"
3941 delta = "0.19.3 -> 0.19.6"
3942 notes = "Maintained by the Glean and Application Services team."
3943
3944 [[audits.uniffi]]
3945 who = "Perry McManis <pmcmanis@mozilla.com>"
3946 criteria = "safe-to-deploy"
3947 delta = "0.19.6 -> 0.20.0"
3948
3949 [[audits.uniffi]]
3950 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3951 criteria = "safe-to-deploy"
3952 delta = "0.20.0 -> 0.21.0"
3953 notes = "Maintained by the Glean and Application Services team."
3954
3955 [[audits.uniffi]]
3956 who = "Mike Hommey <mh+mozilla@glandium.org>"
3957 criteria = "safe-to-deploy"
3958 delta = "0.21.0 -> 0.21.1"
3959 notes = "No changes."
3960
3961 [[audits.uniffi]]
3962 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3963 criteria = "safe-to-deploy"
3964 delta = "0.21.1 -> 0.23.0"
3965 notes = "Maintained by the Glean and Application Services team."
3966
3967 [[audits.uniffi_bindgen]]
3968 who = "Travis Long <tlong@mozilla.com>"
3969 criteria = "safe-to-deploy"
3970 version = "0.19.3"
3971 notes = "Maintained by the Glean and Application Services teams."
3972
3973 [[audits.uniffi_bindgen]]
3974 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3975 criteria = "safe-to-deploy"
3976 delta = "0.19.3 -> 0.19.6"
3977 notes = "Maintained by the Glean and Application Services team."
3978
3979 [[audits.uniffi_bindgen]]
3980 who = "Perry McManis <pmcmanis@mozilla.com>"
3981 criteria = "safe-to-deploy"
3982 delta = "0.19.6 -> 0.20.0"
3983
3984 [[audits.uniffi_bindgen]]
3985 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3986 criteria = "safe-to-deploy"
3987 delta = "0.20.0 -> 0.21.0"
3988 notes = "Maintained by the Glean and Application Services team."
3989
3990 [[audits.uniffi_bindgen]]
3991 who = "Mike Hommey <mh+mozilla@glandium.org>"
3992 criteria = "safe-to-deploy"
3993 delta = "0.21.0 -> 0.21.1"
3994 notes = "I authored the changes in this version."
3995
3996 [[audits.uniffi_bindgen]]
3997 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
3998 criteria = "safe-to-deploy"
3999 delta = "0.21.1 -> 0.23.0"
4000 notes = "Maintained by the Glean and Application Services team."
4001
4002 [[audits.uniffi_build]]
4003 who = "Travis Long <tlong@mozilla.com>"
4004 criteria = "safe-to-deploy"
4005 version = "0.19.3"
4006 notes = "Maintained by the Glean and Application Services teams."
4007
4008 [[audits.uniffi_build]]
4009 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4010 criteria = "safe-to-deploy"
4011 delta = "0.19.3 -> 0.19.6"
4012 notes = "Maintained by the Glean and Application Services team."
4013
4014 [[audits.uniffi_build]]
4015 who = "Perry McManis <pmcmanis@mozilla.com>"
4016 criteria = "safe-to-deploy"
4017 delta = "0.19.6 -> 0.20.0"
4018
4019 [[audits.uniffi_build]]
4020 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4021 criteria = "safe-to-deploy"
4022 delta = "0.20.0 -> 0.21.0"
4023 notes = "Maintained by the Glean and Application Services team."
4024
4025 [[audits.uniffi_build]]
4026 who = "Mike Hommey <mh+mozilla@glandium.org>"
4027 criteria = "safe-to-deploy"
4028 delta = "0.21.0 -> 0.21.1"
4029 notes = "No changes."
4030
4031 [[audits.uniffi_build]]
4032 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4033 criteria = "safe-to-deploy"
4034 delta = "0.21.1 -> 0.23.0"
4035 notes = "Maintained by the Glean and Application Services team."
4036
4037 [[audits.uniffi_checksum_derive]]
4038 who = "Mike Hommey <mh+mozilla@glandium.org>"
4039 criteria = "safe-to-deploy"
4040 version = "0.21.1"
4041 notes = "I authored this crate."
4042
4043 [[audits.uniffi_checksum_derive]]
4044 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4045 criteria = "safe-to-deploy"
4046 delta = "0.21.1 -> 0.23.0"
4047 notes = "Maintained by the Glean and Application Services team."
4048
4049 [[audits.uniffi_core]]
4050 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4051 criteria = "safe-to-deploy"
4052 version = "0.23.0"
4053 notes = "Maintained by the Glean and Application Services teams."
4054
4055 [[audits.uniffi_macros]]
4056 who = "Travis Long <tlong@mozilla.com>"
4057 criteria = "safe-to-deploy"
4058 version = "0.19.3"
4059 notes = "Maintained by the Glean and Application Services teams."
4060
4061 [[audits.uniffi_macros]]
4062 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4063 criteria = "safe-to-deploy"
4064 delta = "0.19.3 -> 0.19.6"
4065 notes = "Maintained by the Glean and Application Services team."
4066
4067 [[audits.uniffi_macros]]
4068 who = "Perry McManis <pmcmanis@mozilla.com>"
4069 criteria = "safe-to-deploy"
4070 delta = "0.19.6 -> 0.20.0"
4071
4072 [[audits.uniffi_macros]]
4073 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4074 criteria = "safe-to-deploy"
4075 delta = "0.20.0 -> 0.21.0"
4076 notes = "Maintained by the Glean and Application Services team."
4077
4078 [[audits.uniffi_macros]]
4079 who = "Mike Hommey <mh+mozilla@glandium.org>"
4080 criteria = "safe-to-deploy"
4081 delta = "0.21.0 -> 0.21.1"
4082 notes = "No changes."
4083
4084 [[audits.uniffi_macros]]
4085 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4086 criteria = "safe-to-deploy"
4087 delta = "0.21.1 -> 0.23.0"
4088 notes = "Maintained by the Glean and Application Services team."
4089
4090 [[audits.uniffi_meta]]
4091 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4092 criteria = "safe-to-deploy"
4093 version = "0.19.6"
4094 notes = "Maintained by the Glean and Application Services team."
4095
4096 [[audits.uniffi_meta]]
4097 who = "Perry McManis <pmcmanis@mozilla.com>"
4098 criteria = "safe-to-deploy"
4099 delta = "0.19.6 -> 0.20.0"
4100
4101 [[audits.uniffi_meta]]
4102 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4103 criteria = "safe-to-deploy"
4104 delta = "0.20.0 -> 0.21.0"
4105 notes = "Maintained by the Glean and Application Services team."
4106
4107 [[audits.uniffi_meta]]
4108 who = "Mike Hommey <mh+mozilla@glandium.org>"
4109 criteria = "safe-to-deploy"
4110 delta = "0.21.0 -> 0.21.1"
4111 notes = "I authored the changes in this version."
4112
4113 [[audits.uniffi_meta]]
4114 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4115 criteria = "safe-to-deploy"
4116 delta = "0.21.1 -> 0.23.0"
4117 notes = "Maintained by the Glean and Application Services team."
4118
4119 [[audits.uniffi_testing]]
4120 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4121 criteria = "safe-to-deploy"
4122 version = "0.23.0"
4123 notes = "Maintained by the Glean and Application Services team."
4124
4125 [[audits.url]]
4126 who = "Valentin Gosu <valentin.gosu@gmail.com>"
4127 criteria = "safe-to-deploy"
4128 version = "2.4.0"
4129
4130 [[audits.url]]
4131 who = "Valentin Gosu <valentin.gosu@gmail.com>"
4132 criteria = "safe-to-deploy"
4133 delta = "2.4.0 -> 2.4.1"
4134
4135 [[audits.url]]
4136 who = "Valentin Gosu <valentin.gosu@gmail.com>"
4137 criteria = "safe-to-deploy"
4138 delta = "2.4.1 -> 2.5.0"
4139
4140 [[audits.uuid]]
4141 who = "Gabriele Svelto <gsvelto@mozilla.com>"
4142 criteria = "safe-to-deploy"
4143 delta = "0.8.2 -> 1.2.2"
4144
4145 [[audits.uuid]]
4146 who = "Mike Hommey <mh+mozilla@glandium.org>"
4147 criteria = "safe-to-deploy"
4148 delta = "1.2.2 -> 1.3.0"
4149
4150 [[audits.void]]
4151 who = "Bobby Holley <bobbyholley@gmail.com>"
4152 criteria = "safe-to-deploy"
4153 version = "1.0.2"
4154 notes = "Very small crate, just hosts the Void type for easier cross-crate interfacing."
4155
4156 [[audits.warp]]
4157 who = "Mike Hommey <mh+mozilla@glandium.org>"
4158 criteria = "safe-to-run"
4159 delta = "0.3.2 -> 0.3.3"
4160
4161 [[audits.warp]]
4162 who = "Bobby Holley <bobbyholley@gmail.com>"
4163 criteria = "safe-to-run"
4164 delta = "0.3.3 -> 0.3.3@git:4af45fae95bc98b0eba1ef0db17e1dac471bb23d"
4165
4166 [[audits.warp]]
4167 who = "Mike Hommey <mh+mozilla@glandium.org>"
4168 criteria = "safe-to-run"
4169 delta = "0.3.6 -> 0.3.6@git:9d081461ae1167eb321585ce424f4fef6cf0092b"
4170
4171 [[audits.wasm-encoder]]
4172 who = "Ryan Hunt <rhunt@eqrion.net>"
4173 criteria = "safe-to-deploy"
4174 version = "0.7.0"
4175 notes = "Maintained by the Bytecode Alliance, with contributions from Mozilla. This has no unsafe code and uses no ambient capabilities."
4176
4177 [[audits.wasm-encoder]]
4178 who = "Ryan Hunt <rhunt@eqrion.net>"
4179 criteria = "safe-to-deploy"
4180 delta = "0.7.0 -> 0.14.0"
4181 notes = "wasm-encoder has no unsafe code and uses no ambient capabilities."
4182
4183 [[audits.wasm-encoder]]
4184 who = "Yury Delendik <ydelendik@mozilla.com>"
4185 criteria = "safe-to-deploy"
4186 delta = "0.14.0 -> 0.15.0"
4187
4188 [[audits.wasm-encoder]]
4189 who = "Yury Delendik <ydelendik@mozilla.com>"
4190 criteria = "safe-to-deploy"
4191 delta = "0.16.0 -> 0.17.0"
4192
4193 [[audits.wasm-encoder]]
4194 who = "Ryan Hunt <rhunt@eqrion.net>"
4195 criteria = "safe-to-deploy"
4196 delta = "0.19.0 -> 0.19.1"
4197
4198 [[audits.wasm-smith]]
4199 who = "Ryan Hunt <rhunt@eqrion.net>"
4200 criteria = "safe-to-deploy"
4201 version = "0.11.2"
4202 notes = "Maintained by the Bytecode Alliance, with contributions from Mozilla. I've vetted the one instance of unsafe code."
4203
4204 [[audits.wasm-smith]]
4205 who = "Yury Delendik <ydelendik@mozilla.com>"
4206 criteria = "safe-to-run"
4207 delta = "0.11.2 -> 0.11.3"
4208
4209 [[audits.wasm-smith]]
4210 who = "Yury Delendik <ydelendik@mozilla.com>"
4211 criteria = "safe-to-run"
4212 delta = "0.11.4 -> 0.11.5"
4213
4214 [[audits.wasm-smith]]
4215 who = "Ryan Hunt <rhunt@eqrion.net>"
4216 criteria = "safe-to-run"
4217 delta = "0.11.7 -> 0.11.8"
4218
4219 [[audits.wasmparser]]
4220 who = "Ryan Hunt <rhunt@eqrion.net>"
4221 criteria = "safe-to-deploy"
4222 version = "0.87.0"
4223 notes = "Maintained by the Bytecode Alliance, with contributions from Mozilla. I've vetted the one instance of unsafe code."
4224
4225 [[audits.wasmparser]]
4226 who = "Yury Delendik <ydelendik@mozilla.com>"
4227 criteria = "safe-to-deploy"
4228 delta = "0.87.0 -> 0.88.0"
4229
4230 [[audits.wasmparser]]
4231 who = "Yury Delendik <ydelendik@mozilla.com>"
4232 criteria = "safe-to-deploy"
4233 delta = "0.89.1 -> 0.91.0"
4234
4235 [[audits.wasmparser]]
4236 who = "Ryan Hunt <rhunt@eqrion.net>"
4237 criteria = "safe-to-deploy"
4238 delta = "0.93.0 -> 0.94.0"
4239
4240 [[audits.wast]]
4241 who = "Ryan Hunt <rhunt@eqrion.net>"
4242 criteria = "safe-to-deploy"
4243 version = "44.0.0"
4244
4245 [[audits.wast]]
4246 who = "Ryan Hunt <rhunt@eqrion.net>"
4247 criteria = "safe-to-deploy"
4248 version = "44.0.0"
4249 notes = "Maintained by the Bytecode Alliance, with contributions from Mozilla. wast has no unsafe code and the only ambient capability it uses is to read the full contents of a file that is given to it."
4250
4251 [[audits.wast]]
4252 who = "Yury Delendik <ydelendik@mozilla.com>"
4253 criteria = "safe-to-deploy"
4254 delta = "44.0.0 -> 45.0.0"
4255
4256 [[audits.wast]]
4257 who = "Yury Delendik <ydelendik@mozilla.com>"
4258 criteria = "safe-to-deploy"
4259 delta = "46.0.0 -> 47.0.0"
4260
4261 [[audits.wast]]
4262 who = "Ryan Hunt <rhunt@eqrion.net>"
4263 criteria = "safe-to-deploy"
4264 delta = "48.0.0 -> 49.0.0"
4265
4266 [[audits.wast]]
4267 who = "Ben Visness <bvisness@mozilla.com>"
4268 criteria = "safe-to-deploy"
4269 delta = "55.0.0 -> 56.0.0"
4270
4271 [[audits.webrtc-sdp]]
4272 who = "Byron Campen <docfaraday@gmail.com>"
4273 criteria = "safe-to-deploy"
4274 delta = "0.3.9 -> 0.3.10"
4275
4276 [[audits.weedle2]]
4277 who = "Travis Long <tlong@mozilla.com>"
4278 criteria = "safe-to-deploy"
4279 version = "3.0.0"
4280 notes = "Maintained by the Glean and Application Services teams."
4281
4282 [[audits.weedle2]]
4283 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4284 criteria = "safe-to-deploy"
4285 delta = "3.0.0 -> 4.0.0"
4286 notes = "Maintained by the Glean and Application Services team."
4287
4288 [[audits.wgpu-core]]
4289 who = "Dzmitry Malyshau <kvark@fastmail.com>"
4290 criteria = "safe-to-deploy"
4291 version = "0.12.0"
4292 notes = """
4293 This crate, up through the indicated version, was written or reviewed
4294 by Dzmitry Malyshau while he was a Mozilla employee. Dzmitry left
4295 Mozilla at the beginning of February 2022. This audit statement was
4296 collected by Jim Blandy, a Mozilla employee, over email in July 2022:
4297 Dzmitry was shown, and agreed to, the 'safe-to-deploy' text.
4298 """
4299
4300 [[audits.wgpu-core]]
4301 who = "Jim Blandy <jimb@mozilla.com>"
4302 criteria = "safe-to-deploy"
4303 delta = "0.12.0 -> 0.13.0"
4304
4305 [[audits.wgpu-core]]
4306 who = "Jim Blandy <jimb@red-bean.com>"
4307 criteria = "safe-to-deploy"
4308 delta = "0.13.0 -> 0.14.0"
4309 notes = "Audit by Erich Gubler, Jim Blandy, Nicolas Silva, and Teodor Tanasoaia."
4310
4311 [[audits.wgpu-core]]
4312 who = "Nicolas Silva <nical@fastmail.com>"
4313 criteria = "safe-to-deploy"
4314 delta = "0.14.0 -> 0.15.0"
4315
4316 [[audits.wgpu-core]]
4317 who = "Nicolas Silva <nical@fastmail.com>"
4318 criteria = "safe-to-deploy"
4319 delta = "0.15.0 -> 0.16.0"
4320
4321 [[audits.wgpu-core]]
4322 who = "Nicolas Silva <nical@fastmail.com>"
4323 criteria = "safe-to-deploy"
4324 delta = "0.16.0 -> 0.17.0"
4325
4326 [[audits.wgpu-core]]
4327 who = "Nicolas Silva <nical@fastmail.com>"
4328 criteria = "safe-to-deploy"
4329 delta = "0.17.0 -> 0.18.0"
4330
4331 [[audits.wgpu-core]]
4332 who = [
4333     "Jim Blandy <jimb@red-bean.com>",
4334     "Nicolas Silva <nical@fastmail.com>",
4335     "Teodor Tanasoaia <ttanasoaia@mozilla.com>",
4336 ]
4337 criteria = "safe-to-deploy"
4338 delta = "0.18.0 -> 0.18.0@git:c6eea50b04127abe2340b93141123312baf5414b"
4339 importable = false
4340
4341 [[audits.wgpu-hal]]
4342 who = "Dzmitry Malyshau <kvark@fastmail.com>"
4343 criteria = "safe-to-deploy"
4344 version = "0.12.0"
4345 notes = """
4346 This crate, up through the indicated version, was written or reviewed
4347 by Dzmitry Malyshau while he was a Mozilla employee. Dzmitry left
4348 Mozilla at the beginning of February 2022. This audit statement was
4349 collected by Jim Blandy, a Mozilla employee, over email in July 2022:
4350 Dzmitry was shown, and agreed to, the 'safe-to-deploy' text.
4351 """
4352
4353 [[audits.wgpu-hal]]
4354 who = "Jim Blandy <jimb@mozilla.com>"
4355 criteria = "safe-to-deploy"
4356 delta = "0.12.0 -> 0.13.0"
4357
4358 [[audits.wgpu-hal]]
4359 who = "Jim Blandy <jimb@red-bean.com>"
4360 criteria = "safe-to-deploy"
4361 delta = "0.13.0 -> 0.14.0"
4362 notes = "Audit by Erich Gubler, Jim Blandy, Nicolas Silva, and Teodor Tanasoaia."
4363
4364 [[audits.wgpu-hal]]
4365 who = "Nicolas Silva <nical@fastmail.com>"
4366 criteria = "safe-to-deploy"
4367 delta = "0.14.0 -> 0.15.0"
4368
4369 [[audits.wgpu-hal]]
4370 who = "Nicolas Silva <nical@fastmail.com>"
4371 criteria = "safe-to-deploy"
4372 delta = "0.15.0 -> 0.16.0"
4373
4374 [[audits.wgpu-hal]]
4375 who = "Nicolas Silva <nical@fastmail.com>"
4376 criteria = "safe-to-deploy"
4377 delta = "0.16.0 -> 0.17.0"
4378
4379 [[audits.wgpu-hal]]
4380 who = "Nicolas Silva <nical@fastmail.com>"
4381 criteria = "safe-to-deploy"
4382 delta = "0.17.0 -> 0.18.0"
4383
4384 [[audits.wgpu-hal]]
4385 who = [
4386     "Jim Blandy <jimb@red-bean.com>",
4387     "Nicolas Silva <nical@fastmail.com>",
4388     "Teodor Tanasoaia <ttanasoaia@mozilla.com>",
4389 ]
4390 criteria = "safe-to-deploy"
4391 delta = "0.18.0 -> 0.18.0@git:c6eea50b04127abe2340b93141123312baf5414b"
4392 importable = false
4393
4394 [[audits.wgpu-types]]
4395 who = "Dzmitry Malyshau <kvark@fastmail.com>"
4396 criteria = "safe-to-deploy"
4397 version = "0.12.0"
4398 notes = """
4399 This crate, up through the indicated version, was written or reviewed
4400 by Dzmitry Malyshau while he was a Mozilla employee. Dzmitry left
4401 Mozilla at the beginning of February 2022. This audit statement was
4402 collected by Jim Blandy, a Mozilla employee, over email in July 2022:
4403 Dzmitry was shown, and agreed to, the 'safe-to-deploy' text.
4404 """
4405
4406 [[audits.wgpu-types]]
4407 who = "Jim Blandy <jimb@mozilla.com>"
4408 criteria = "safe-to-deploy"
4409 delta = "0.12.0 -> 0.13.0"
4410
4411 [[audits.wgpu-types]]
4412 who = "Jim Blandy <jimb@red-bean.com>"
4413 criteria = "safe-to-deploy"
4414 delta = "0.13.0 -> 0.14.0"
4415 notes = "Audit by Erich Gubler, Jim Blandy, Nicolas Silva, and Teodor Tanasoaia."
4416
4417 [[audits.wgpu-types]]
4418 who = "Nicolas Silva <nical@fastmail.com>"
4419 criteria = "safe-to-deploy"
4420 delta = "0.14.0 -> 0.15.0"
4421
4422 [[audits.wgpu-types]]
4423 who = "Nicolas Silva <nical@fastmail.com>"
4424 criteria = "safe-to-deploy"
4425 delta = "0.15.0 -> 0.16.0"
4426
4427 [[audits.wgpu-types]]
4428 who = "Nicolas Silva <nical@fastmail.com>"
4429 criteria = "safe-to-deploy"
4430 delta = "0.16.0 -> 0.17.0"
4431
4432 [[audits.wgpu-types]]
4433 who = "Nicolas Silva <nical@fastmail.com>"
4434 criteria = "safe-to-deploy"
4435 delta = "0.17.0 -> 0.18.0"
4436
4437 [[audits.wgpu-types]]
4438 who = [
4439     "Jim Blandy <jimb@red-bean.com>",
4440     "Nicolas Silva <nical@fastmail.com>",
4441     "Teodor Tanasoaia <ttanasoaia@mozilla.com>",
4442 ]
4443 criteria = "safe-to-deploy"
4444 delta = "0.18.0 -> 0.18.0@git:c6eea50b04127abe2340b93141123312baf5414b"
4445 importable = false
4446
4447 [[audits.whatsys]]
4448 who = "Bobby Holley <bobbyholley@gmail.com>"
4449 criteria = "safe-to-deploy"
4450 version = "0.1.2"
4451 notes = """
4452 Contains platform-specific FFI code for apple, mac, and windows. The windows code
4453 also contains a small C file compiled at build-time. I audited all of it and it
4454 looks correct.
4455 """
4456
4457 [[audits.whatsys]]
4458 who = "Jan-Erik Rediger <jrediger@mozilla.com>"
4459 criteria = "safe-to-deploy"
4460 delta = "0.1.2 -> 0.3.1"
4461 notes = "Maintained by me. I have written or reviewed all of the code."
4462
4463 [[audits.winreg]]
4464 who = "Ray Kraesig <rkraesig@mozilla.com>"
4465 criteria = "safe-to-run"
4466 version = "0.10.1"
4467 notes = """
4468 This crate uses a lot of `unsafe`; not all of it is necessary, and not all of it
4469 is correct. (In particular, the alignment of data buffers does not seem to be
4470 correctly ensured at type-conversion time.) However, the code is not deceptive,
4471 and any more subtle issues do not appear to be exploitable -- certainly not from
4472 a test environment.
4473 """
4474
4475 [[audits.wpf-gpu-raster]]
4476 who = "Lee Salzman <lsalzman@mozilla.com>"
4477 criteria = "safe-to-deploy"
4478 version = "0.1.0"
4479 notes = "Written and maintained by Gfx team at Mozilla."
4480
4481 [[audits.writeable]]
4482 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4483 criteria = "safe-to-deploy"
4484 version = "0.5.2"
4485 notes = "writeable is a variation of fmt::Write with sink version. This uses `unsafe` block to handle potentially-invalid UTF-8 character. I've vetted the one instance of unsafe code."
4486
4487 [[audits.writeable]]
4488 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4489 criteria = "safe-to-deploy"
4490 delta = "0.5.2 -> 0.5.4"
4491
4492 [[audits.xmldecl]]
4493 who = "Henri Sivonen <hsivonen@hsivonen.fi>"
4494 criteria = "safe-to-deploy"
4495 version = "0.2.0"
4496 notes = "I, Henri Sivonen, wrote this crate myself for Gecko even though it's published on crates.io."
4497
4498 [[audits.yoke]]
4499 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4500 criteria = "safe-to-deploy"
4501 version = "0.7.1"
4502 notes = "This crate is for zero-copy serialization for ICU4X data structure, and maintained by ICU4X team. Since this uses unsafe block for serialization, I audited code."
4503
4504 [[audits.yoke]]
4505 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4506 criteria = "safe-to-deploy"
4507 delta = "0.7.1 -> 0.7.3"
4508
4509 [[audits.yoke-derive]]
4510 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4511 criteria = "safe-to-deploy"
4512 version = "0.7.1@git:14e9a3a9857be74582abe2dfa7ab799c5eaac873"
4513 notes = "This crate is a helper for yoke crate that is ICU4X data structure, and maintained by ICU4X team. Since this uses unsafe block for serialization, all has the comment why this uses unsafe and I audited code."
4514
4515 [[audits.yoke-derive]]
4516 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4517 criteria = "safe-to-deploy"
4518 version = "0.7.3"
4519
4520 [[audits.zerofrom]]
4521 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4522 criteria = "safe-to-deploy"
4523 version = "0.1.2"
4524 notes = "This crate is zero-copy version of \"From\". This has no unsafe code and uses no ambient capabilities."
4525
4526 [[audits.zerofrom-derive]]
4527 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4528 criteria = "safe-to-deploy"
4529 version = "0.1.2@git:14e9a3a9857be74582abe2dfa7ab799c5eaac873"
4530 notes = "This is custom derives for `ZeroFrom` that is from zerofrom crate. This has no unsafe code and uses no ambient capabilities."
4531
4532 [[audits.zerofrom-derive]]
4533 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4534 criteria = "safe-to-deploy"
4535 version = "0.1.3"
4536
4537 [[audits.zerovec]]
4538 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4539 criteria = "safe-to-deploy"
4540 version = "0.9.4"
4541 notes = "This crate is zero-copy data structure implmentation. Although this uses unsafe block in several code, it requires for zero-copy. And this has a comment in code why this uses unsafe and I audited code."
4542
4543 [[audits.zerovec]]
4544 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4545 criteria = "safe-to-deploy"
4546 delta = "0.9.4 -> 0.10.1"
4547
4548 [[audits.zerovec-derive]]
4549 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4550 criteria = "safe-to-deploy"
4551 version = "0.9.4@git:14e9a3a9857be74582abe2dfa7ab799c5eaac873"
4552 notes = "This is custom derives for `ZeroVec` that is from zerovec crate. Although this uses unsafe block for zero-copy, this has a comment in code why this uses unsafe and I audited code."
4553
4554 [[audits.zerovec-derive]]
4555 who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
4556 criteria = "safe-to-deploy"
4557 version = "0.10.1"
4558
4559 [[audits.zip]]
4560 who = "Mike Hommey <mh+mozilla@glandium.org>"
4561 criteria = "safe-to-run"
4562 delta = "0.6.2 -> 0.6.3"
4563
4564 [[audits.zip]]
4565 who = "Mike Hommey <mh+mozilla@glandium.org>"
4566 criteria = "safe-to-run"
4567 delta = "0.6.3 -> 0.6.4"
4568
4569 [[trusted.aho-corasick]]
4570 criteria = "safe-to-deploy"
4571 user-id = 189 # Andrew Gallant (BurntSushi)
4572 start = "2019-03-28"
4573 end = "2024-05-03"
4574
4575 [[trusted.anstyle]]
4576 criteria = "safe-to-deploy"
4577 user-id = 6743 # Ed Page (epage)
4578 start = "2022-05-18"
4579 end = "2024-09-28"
4580
4581 [[trusted.async-trait]]
4582 criteria = "safe-to-deploy"
4583 user-id = 3618 # David Tolnay (dtolnay)
4584 start = "2019-07-23"
4585 end = "2024-04-25"
4586
4587 [[trusted.atomic]]
4588 criteria = "safe-to-deploy"
4589 user-id = 2915 # Amanieu d'Antras (Amanieu)
4590 start = "2019-02-22"
4591 end = "2024-05-05"
4592
4593 [[trusted.byteorder]]
4594 criteria = "safe-to-deploy"
4595 user-id = 189 # Andrew Gallant (BurntSushi)
4596 start = "2019-06-09"
4597 end = "2024-05-03"
4598
4599 [[trusted.bytes]]
4600 criteria = "safe-to-deploy"
4601 user-id = 6741 # Alice Ryhl (Darksonn)
4602 start = "2021-01-11"
4603 end = "2024-05-05"
4604
4605 [[trusted.clap]]
4606 criteria = "safe-to-deploy"
4607 user-id = 6743 # Ed Page (epage)
4608 start = "2021-12-08"
4609 end = "2024-06-02"
4610
4611 [[trusted.clap_builder]]
4612 criteria = "safe-to-deploy"
4613 user-id = 6743 # Ed Page (epage)
4614 start = "2023-03-28"
4615 end = "2024-06-02"
4616
4617 [[trusted.clap_derive]]
4618 criteria = "safe-to-deploy"
4619 user-id = 6743 # Ed Page (epage)
4620 start = "2021-12-08"
4621 end = "2024-06-02"
4622
4623 [[trusted.clap_lex]]
4624 criteria = "safe-to-deploy"
4625 user-id = 6743 # Ed Page (epage)
4626 start = "2022-04-15"
4627 end = "2024-06-02"
4628
4629 [[trusted.dtoa]]
4630 criteria = "safe-to-deploy"
4631 user-id = 3618 # David Tolnay (dtolnay)
4632 start = "2019-05-02"
4633 end = "2024-04-25"
4634
4635 [[trusted.equivalent]]
4636 criteria = "safe-to-deploy"
4637 user-id = 539 # Josh Stone (cuviper)
4638 start = "2023-02-05"
4639 end = "2024-07-17"
4640
4641 [[trusted.flate2]]
4642 criteria = "safe-to-deploy"
4643 user-id = 4333 # Josh Triplett (joshtriplett)
4644 start = "2020-09-30"
4645 end = "2024-05-05"
4646
4647 [[trusted.h2]]
4648 criteria = "safe-to-deploy"
4649 user-id = 359 # Sean McArthur (seanmonstar)
4650 start = "2019-03-13"
4651 end = "2024-12-05"
4652
4653 [[trusted.hashbrown]]
4654 criteria = "safe-to-deploy"
4655 user-id = 2915 # Amanieu d'Antras (Amanieu)
4656 start = "2019-04-02"
4657 end = "2024-07-17"
4658
4659 [[trusted.headers]]
4660 criteria = "safe-to-deploy"
4661 user-id = 359 # Sean McArthur (seanmonstar)
4662 start = "2019-09-09"
4663 end = "2024-04-25"
4664
4665 [[trusted.httparse]]
4666 criteria = "safe-to-deploy"
4667 user-id = 359 # Sean McArthur (seanmonstar)
4668 start = "2019-07-03"
4669 end = "2024-04-25"
4670
4671 [[trusted.indexmap]]
4672 criteria = "safe-to-deploy"
4673 user-id = 539 # Josh Stone (cuviper)
4674 start = "2020-01-15"
4675 end = "2024-05-05"
4676
4677 [[trusted.inherent]]
4678 criteria = "safe-to-deploy"
4679 user-id = 3618 # David Tolnay (dtolnay)
4680 start = "2019-07-14"
4681 end = "2024-04-25"
4682
4683 [[trusted.iovec]]
4684 criteria = "safe-to-deploy"
4685 user-id = 10 # Carl Lerche (carllerche)
4686 start = "2019-10-09"
4687 end = "2024-05-05"
4688
4689 [[trusted.itoa]]
4690 criteria = "safe-to-deploy"
4691 user-id = 3618 # David Tolnay (dtolnay)
4692 start = "2019-05-02"
4693 end = "2024-04-25"
4694
4695 [[trusted.jobserver]]
4696 criteria = "safe-to-deploy"
4697 user-id = 1 # Alex Crichton (alexcrichton)
4698 start = "2019-03-15"
4699 end = "2024-05-05"
4700
4701 [[trusted.libc]]
4702 criteria = "safe-to-deploy"
4703 user-id = 2915 # Amanieu d'Antras (Amanieu)
4704 start = "2021-01-27"
4705 end = "2024-05-05"
4706
4707 [[trusted.libc]]
4708 criteria = "safe-to-deploy"
4709 user-id = 51017 # Yuki Okushi (JohnTitor)
4710 start = "2020-03-17"
4711 end = "2024-10-25"
4712
4713 [[trusted.linux-raw-sys]]
4714 criteria = "safe-to-deploy"
4715 user-id = 6825 # Dan Gohman (sunfishcode)
4716 start = "2021-06-12"
4717 end = "2024-09-08"
4718
4719 [[trusted.lock_api]]
4720 criteria = "safe-to-deploy"
4721 user-id = 2915 # Amanieu d'Antras (Amanieu)
4722 start = "2019-05-04"
4723 end = "2024-05-05"
4724
4725 [[trusted.memchr]]
4726 criteria = "safe-to-deploy"
4727 user-id = 189 # Andrew Gallant (BurntSushi)
4728 start = "2019-07-07"
4729 end = "2024-05-03"
4730
4731 [[trusted.mime]]
4732 criteria = "safe-to-deploy"
4733 user-id = 359 # Sean McArthur (seanmonstar)
4734 start = "2019-09-09"
4735 end = "2024-04-25"
4736
4737 [[trusted.mio]]
4738 criteria = "safe-to-deploy"
4739 user-id = 10 # Carl Lerche (carllerche)
4740 start = "2019-05-15"
4741 end = "2024-05-06"
4742
4743 [[trusted.num_cpus]]
4744 criteria = "safe-to-deploy"
4745 user-id = 359 # Sean McArthur (seanmonstar)
4746 start = "2019-06-10"
4747 end = "2024-04-25"
4748
4749 [[trusted.ordered-float]]
4750 criteria = "safe-to-deploy"
4751 user-id = 2017 # Matt Brubeck (mbrubeck)
4752 start = "2019-03-13"
4753 end = "2024-05-06"
4754
4755 [[trusted.parking_lot]]
4756 criteria = "safe-to-deploy"
4757 user-id = 2915 # Amanieu d'Antras (Amanieu)
4758 start = "2019-05-04"
4759 end = "2024-05-05"
4760
4761 [[trusted.parking_lot_core]]
4762 criteria = "safe-to-deploy"
4763 user-id = 2915 # Amanieu d'Antras (Amanieu)
4764 start = "2019-05-04"
4765 end = "2024-05-05"
4766
4767 [[trusted.paste]]
4768 criteria = "safe-to-deploy"
4769 user-id = 3618 # David Tolnay (dtolnay)
4770 start = "2019-03-19"
4771 end = "2024-04-25"
4772
4773 [[trusted.proc-macro-hack]]
4774 criteria = "safe-to-deploy"
4775 user-id = 3618 # David Tolnay (dtolnay)
4776 start = "2019-04-16"
4777 end = "2024-04-25"
4778
4779 [[trusted.proc-macro2]]
4780 criteria = "safe-to-deploy"
4781 user-id = 3618 # David Tolnay (dtolnay)
4782 start = "2019-04-23"
4783 end = "2024-05-30"
4784
4785 [[trusted.quote]]
4786 criteria = "safe-to-deploy"
4787 user-id = 3618 # David Tolnay (dtolnay)
4788 start = "2019-04-09"
4789 end = "2024-05-30"
4790
4791 [[trusted.regex]]
4792 criteria = "safe-to-deploy"
4793 user-id = 189 # Andrew Gallant (BurntSushi)
4794 start = "2019-02-27"
4795 end = "2024-05-03"
4796
4797 [[trusted.regex-automata]]
4798 criteria = "safe-to-deploy"
4799 user-id = 189 # Andrew Gallant (BurntSushi)
4800 start = "2019-02-25"
4801 end = "2024-09-20"
4802
4803 [[trusted.regex-syntax]]
4804 criteria = "safe-to-deploy"
4805 user-id = 189 # Andrew Gallant (BurntSushi)
4806 start = "2019-03-30"
4807 end = "2024-05-03"
4808
4809 [[trusted.rustix]]
4810 criteria = "safe-to-deploy"
4811 user-id = 6825 # Dan Gohman (sunfishcode)
4812 start = "2021-10-29"
4813 end = "2024-09-08"
4814
4815 [[trusted.ryu]]
4816 criteria = "safe-to-deploy"
4817 user-id = 3618 # David Tolnay (dtolnay)
4818 start = "2019-05-02"
4819 end = "2024-04-25"
4820
4821 [[trusted.same-file]]
4822 criteria = "safe-to-deploy"
4823 user-id = 189 # Andrew Gallant (BurntSushi)
4824 start = "2019-07-16"
4825 end = "2024-05-03"
4826
4827 [[trusted.scopeguard]]
4828 criteria = "safe-to-deploy"
4829 user-id = 2915 # Amanieu d'Antras (Amanieu)
4830 start = "2020-02-16"
4831 end = "2024-05-05"
4832
4833 [[trusted.serde]]
4834 criteria = "safe-to-deploy"
4835 user-id = 3618 # David Tolnay (dtolnay)
4836 start = "2019-03-01"
4837 end = "2024-04-25"
4838
4839 [[trusted.serde_bytes]]
4840 criteria = "safe-to-deploy"
4841 user-id = 3618 # David Tolnay (dtolnay)
4842 start = "2019-02-25"
4843 end = "2024-04-25"
4844
4845 [[trusted.serde_derive]]
4846 criteria = "safe-to-deploy"
4847 user-id = 3618 # David Tolnay (dtolnay)
4848 start = "2019-03-01"
4849 end = "2024-04-25"
4850
4851 [[trusted.serde_json]]
4852 criteria = "safe-to-deploy"
4853 user-id = 3618 # David Tolnay (dtolnay)
4854 start = "2019-02-28"
4855 end = "2024-04-25"
4856
4857 [[trusted.serde_repr]]
4858 criteria = "safe-to-deploy"
4859 user-id = 3618 # David Tolnay (dtolnay)
4860 start = "2019-04-26"
4861 end = "2024-04-25"
4862
4863 [[trusted.serde_yaml]]
4864 criteria = "safe-to-deploy"
4865 user-id = 3618 # David Tolnay (dtolnay)
4866 start = "2019-05-02"
4867 end = "2024-04-25"
4868
4869 [[trusted.smallvec]]
4870 criteria = "safe-to-deploy"
4871 user-id = 2017 # Matt Brubeck (mbrubeck)
4872 start = "2019-10-28"
4873 end = "2024-05-06"
4874
4875 [[trusted.syn]]
4876 criteria = "safe-to-deploy"
4877 user-id = 3618 # David Tolnay (dtolnay)
4878 start = "2019-03-01"
4879 end = "2024-04-25"
4880
4881 [[trusted.termcolor]]
4882 criteria = "safe-to-deploy"
4883 user-id = 189 # Andrew Gallant (BurntSushi)
4884 start = "2019-06-04"
4885 end = "2024-05-03"
4886
4887 [[trusted.thiserror]]
4888 criteria = "safe-to-deploy"
4889 user-id = 3618 # David Tolnay (dtolnay)
4890 start = "2019-10-09"
4891 end = "2024-04-25"
4892
4893 [[trusted.thiserror-impl]]
4894 criteria = "safe-to-deploy"
4895 user-id = 3618 # David Tolnay (dtolnay)
4896 start = "2019-10-09"
4897 end = "2024-04-25"
4898
4899 [[trusted.threadbound]]
4900 criteria = "safe-to-deploy"
4901 user-id = 3618 # David Tolnay (dtolnay)
4902 start = "2020-06-16"
4903 end = "2024-04-25"
4904
4905 [[trusted.tokio-macros]]
4906 criteria = "safe-to-deploy"
4907 user-id = 6741 # Alice Ryhl (Darksonn)
4908 start = "2020-10-26"
4909 end = "2024-05-05"
4910
4911 [[trusted.tokio-util]]
4912 criteria = "safe-to-deploy"
4913 user-id = 6741 # Alice Ryhl (Darksonn)
4914 start = "2021-01-12"
4915 end = "2024-05-05"
4916
4917 [[trusted.toml]]
4918 criteria = "safe-to-deploy"
4919 user-id = 1 # Alex Crichton (alexcrichton)
4920 start = "2019-05-16"
4921 end = "2024-05-06"
4922
4923 [[trusted.unicode-ident]]
4924 criteria = "safe-to-deploy"
4925 user-id = 3618 # David Tolnay (dtolnay)
4926 start = "2021-10-02"
4927 end = "2024-04-25"
4928
4929 [[trusted.walkdir]]
4930 criteria = "safe-to-deploy"
4931 user-id = 189 # Andrew Gallant (BurntSushi)
4932 start = "2019-06-09"
4933 end = "2024-05-03"
4934
4935 [[trusted.warp]]
4936 criteria = "safe-to-deploy"
4937 user-id = 359 # Sean McArthur (seanmonstar)
4938 start = "2019-03-20"
4939 end = "2024-05-08"
4940
4941 [[trusted.wasi]]
4942 criteria = "safe-to-deploy"
4943 user-id = 1 # Alex Crichton (alexcrichton)
4944 start = "2020-06-03"
4945 end = "2024-05-05"
4946
4947 [[trusted.winapi-util]]
4948 criteria = "safe-to-deploy"
4949 user-id = 189 # Andrew Gallant (BurntSushi)
4950 start = "2020-01-11"
4951 end = "2024-05-03"
4952
4953 [[trusted.windows-sys]]
4954 criteria = "safe-to-deploy"
4955 user-id = 64539 # Kenny Kerr (kennykerr)
4956 start = "2021-11-15"
4957 end = "2024-09-12"