github
/
cranelift
mirror of https://github.com/bytecodealliance/wasmtime.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
12035 Commits
49 Branches
140 Tags
128 MiB
Tree: a34427a3d2
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'a34427a3d2'
${ noResults }
cranelift/supply-chain/imports.lock

1727 lines
43 KiB
Raw Normal View History

Enable cargo-vet (#4444) * Initialize cargo-vet on wasmtime. * Add cargo-vet to CI. * Add README.
2 years ago
# cargo-vet imports lock
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[unpublished.cranelift]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-bforest]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-codegen]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-codegen-meta]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-codegen-shared]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-control]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-entity]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-frontend]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-interpreter]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-isle]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-jit]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-module]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-native]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-object]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-reader]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-serde]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.cranelift-wasm]]
version = "0.100.0"
audited_as = "0.98.1"
[[unpublished.wasi-cap-std-sync]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasi-common]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasi-tokio]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-asm-macros]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-cache]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-cli]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-cli-flags]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-component-macro]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-component-util]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-cranelift]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-cranelift-shared]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-environ]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-explorer]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-fiber]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-jit]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-jit-debug]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-jit-icache-coherence]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-runtime]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-types]]
version = "13.0.0"
audited_as = "11.0.1"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
[[unpublished.wasmtime-wasi]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-wasi-http]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-wasi-nn]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-wasi-threads]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-wast]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-winch]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wasmtime-wit-bindgen]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wiggle]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wiggle-generate]]
version = "13.0.0"
audited_as = "11.0.1"
[[unpublished.wiggle-macro]]
version = "13.0.0"
audited_as = "11.0.1"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
[[unpublished.wiggle-test]]
version = "0.0.0"
audited_as = "0.1.0"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[unpublished.winch-codegen]]
version = "0.11.0"
audited_as = "0.9.1"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.aho-corasick]]
version = "1.0.2"
when = "2023-06-04"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.anstream]]
version = "0.3.2"
when = "2023-05-01"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.anstyle]]
version = "1.0.1"
when = "2023-06-20"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.anstyle-parse]]
version = "0.2.1"
when = "2023-06-20"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.anstyle-query]]
version = "1.0.0"
when = "2023-04-13"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.anstyle-wincon]]
version = "1.0.1"
when = "2023-04-24"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
fuzz: randomize block lowering order (#6254) * fuzz: randomize block lowering order Co-authored-by: Moritz Waser <mzrw.dev@pm.me> Co-authored-by: Remo Senekowitsch <contact@remlse.dev> * fix block lowering order randomization Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * simplify control plane internals Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * avoid unnecessary allocations Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * remove unused change_order function Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * add arbitrary 1.3.0 to cargo vet imports lock Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * optimize ControlPlane::shuffle Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * clarify shuffle being a noop without chaos mode Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * reorder only direct successors of a block Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * rename get_permutation -> shuffled Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> --------- Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me>
2 years ago
[[publisher.arbitrary]]
version = "1.3.0"
when = "2023-03-13"
user-id = 696
user-login = "fitzgen"
user-name = "Nick Fitzgerald"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.async-trait]]
version = "0.1.71"
when = "2023-07-05"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.backtrace]]
version = "0.3.68"
when = "2023-06-29"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.bstr]]
version = "1.6.0"
when = "2023-07-05"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
wasmtime: Overhaul trampolines (#6262) This commit splits `VMCallerCheckedFuncRef::func_ptr` into three new function pointers: `VMCallerCheckedFuncRef::{wasm,array,native}_call`. Each one has a dedicated calling convention, so callers just choose the version that works for them. This is as opposed to the previous behavior where we would chain together many trampolines that converted between calling conventions, sometimes up to four on the way into Wasm and four more on the way back out. See [0] for details. [0] https://github.com/bytecodealliance/rfcs/blob/main/accepted/tail-calls.md#a-review-of-our-existing-trampolines-calling-conventions-and-call-paths Thanks to @bjorn3 for the initial idea of having multiple function pointers for different calling conventions. This is generally a nice ~5-10% speed up to our call benchmarks across the board: both Wasm-to-host and host-to-Wasm. The one exception is typed calls from Wasm to the host, which have a minor regression. We hypothesize that this is because the old hand-written assembly trampolines did not maintain a call frame and do a tail call, but the new Cranelift-generated trampolines do maintain a call frame and do a regular call. The regression is only a couple nanoseconds, which seems well-explained by these differences explain, and ultimately is not a big deal. However, this does lead to a ~5% code size regression for compiled modules. Before, we compiled a trampoline per escaping function's signature and we deduplicated these trampolines by signature. Now we compile two trampolines per escaping function: one for if the host calls via the array calling convention and one for it the host calls via the native calling convention. Additionally, we compile a trampoline for every type in the module, in case there is a native calling convention function from the host that we `call_indirect` of that type. Much of this is in the `.eh_frame` section in the compiled module, because each of our trampolines needs an entry there. Note that the `.eh_frame` section is not required for Wasmtime's correctness, and you can disable its generation to shrink compiled module code size; we just emit it to play nice with external unwinders and profilers. We believe there are code size gains available for follow up work to offset this code size regression in the future. Backing up a bit: the reason each Wasm module needs to provide these Wasm-to-native trampolines is because `wasmtime::Func::wrap` and friends allow embedders to create functions even when there is no compiler available, so they cannot bring their own trampoline. Instead the Wasm module has to supply it. This in turn means that we need to look up and patch in these Wasm-to-native trampolines during roughly instantiation time. But instantiation is super hot, and we don't want to add more passes over imports or any extra work on this path. So we integrate with `wasmtime::InstancePre` to patch these trampolines in ahead of time. Co-Authored-By: Jamey Sharp <jsharp@fastly.com> Co-Authored-By: Alex Crichton <alex@alexcrichton.com> prtest:full
2 years ago
[[publisher.bumpalo]]
version = "3.12.0"
when = "2023-01-17"
user-id = 696
user-login = "fitzgen"
user-name = "Nick Fitzgerald"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.byteorder]]
version = "1.4.3"
when = "2021-03-10"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.cap-fs-ext]]
version = "2.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.cap-primitives]]
version = "2.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.cap-rand]]
version = "2.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.cap-std]]
version = "2.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.cap-tempfile]]
version = "2.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.cap-time-ext]]
version = "2.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.clap]]
version = "4.3.12"
when = "2023-07-14"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.clap_builder]]
version = "4.3.12"
when = "2023-07-14"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.clap_derive]]
version = "4.3.12"
when = "2023-07-14"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
[[publisher.clap_lex]]
version = "0.5.0"
when = "2023-05-19"
user-id = 6743
user-login = "epage"
user-name = "Ed Page"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.cranelift]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-bforest]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-codegen]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-codegen-meta]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-codegen-shared]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-control]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-entity]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-frontend]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-interpreter]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-isle]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-jit]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-module]]
version = "0.98.1"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.cranelift-native]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-object]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-reader]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-serde]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.cranelift-wasm]]
version = "0.98.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
fuzz: randomize block lowering order (#6254) * fuzz: randomize block lowering order Co-authored-by: Moritz Waser <mzrw.dev@pm.me> Co-authored-by: Remo Senekowitsch <contact@remlse.dev> * fix block lowering order randomization Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * simplify control plane internals Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * avoid unnecessary allocations Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * remove unused change_order function Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * add arbitrary 1.3.0 to cargo vet imports lock Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * optimize ControlPlane::shuffle Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * clarify shuffle being a noop without chaos mode Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * reorder only direct successors of a block Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> * rename get_permutation -> shuffled Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me> --------- Co-authored-by: Falk Zwimpfer <24669719+FalkZ@users.noreply.github.com> Co-authored-by: Moritz Waser <mzrw.dev@pm.me>
2 years ago
[[publisher.derive_arbitrary]]
version = "1.3.0"
when = "2023-03-13"
user-id = 696
user-login = "fitzgen"
user-name = "Nick Fitzgerald"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.equivalent]]
version = "1.0.1"
when = "2023-07-10"
user-id = 539
user-login = "cuviper"
user-name = "Josh Stone"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.fd-lock]]
version = "4.0.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.filecheck]]
version = "0.5.0"
when = "2020-03-17"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.fs-set-times]]
version = "0.20.0"
when = "2023-06-29"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.hashbrown]]
version = "0.14.0"
when = "2023-06-05"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.indexmap]]
version = "1.9.1"
when = "2022-06-21"
user-id = 539
user-login = "cuviper"
user-name = "Josh Stone"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.indexmap]]
version = "2.0.0"
when = "2023-06-23"
user-id = 539
user-login = "cuviper"
user-name = "Josh Stone"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.io-extras]]
version = "0.18.0"
when = "2023-06-11"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.io-lifetimes]]
version = "2.0.2"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.itoa]]
version = "1.0.1"
when = "2021-12-12"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.libc]]
version = "0.2.146"
when = "2023-06-06"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.libm]]
version = "0.2.7"
when = "2023-05-15"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.linux-raw-sys]]
version = "0.4.3"
when = "2023-06-14"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.memchr]]
version = "2.5.0"
when = "2022-04-30"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.paste]]
version = "1.0.7"
when = "2022-03-27"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.quote]]
version = "1.0.29"
when = "2023-06-29"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Cranelift: upgrade to regalloc2 0.9.2. (#6726) * Cranelift: upgrade to regalloc2 0.9.2. This pulls in bytecodealliance/regalloc2#152, which fixes a bug that is reachable on RISC-V: when two different register classes have the same stackslot size, the register allocation result might share a slot between two different classes, which can result in moves between classes that will cause a panic. The fix properly separates slots by class. * cargo-vet update for regalloc2 0.9.2.
1 year ago
[[publisher.regalloc2]]
version = "0.9.2"
when = "2023-07-14"
user-id = 3726
user-login = "cfallin"
user-name = "Chris Fallin"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.regex]]
version = "1.9.1"
when = "2023-07-07"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
[[publisher.regex-automata]]
version = "0.1.10"
when = "2021-06-01"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
[[publisher.regex-automata]]
version = "0.3.3"
when = "2023-07-12"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
[[publisher.regex-syntax]]
version = "0.6.25"
when = "2021-05-02"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
[[publisher.regex-syntax]]
version = "0.7.4"
when = "2023-07-11"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.rustix]]
version = "0.38.4"
when = "2023-07-11"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.ryu]]
version = "1.0.9"
when = "2021-12-12"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.same-file]]
version = "1.0.6"
when = "2020-01-11"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.scopeguard]]
version = "1.1.0"
when = "2020-02-16"
user-id = 2915
user-login = "Amanieu"
user-name = "Amanieu d'Antras"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.serde]]
version = "1.0.171"
when = "2023-07-10"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.serde_derive]]
version = "1.0.171"
when = "2023-07-10"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.serde_json]]
version = "1.0.80"
when = "2022-04-30"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.spdx]]
version = "0.10.1"
when = "2023-04-06"
user-id = 52553
user-login = "embark-studios"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.syn]]
version = "1.0.92"
when = "2022-04-29"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.syn]]
version = "2.0.25"
when = "2023-07-09"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.system-interface]]
version = "0.26.0"
when = "2023-06-30"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
[[publisher.target-lexicon]]
version = "0.12.3"
when = "2022-02-01"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.termcolor]]
version = "1.1.3"
when = "2022-03-02"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.thiserror]]
version = "1.0.43"
when = "2023-07-07"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
[[publisher.thiserror-impl]]
version = "1.0.43"
when = "2023-07-07"
user-id = 3618
user-login = "dtolnay"
user-name = "David Tolnay"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today's Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I'm adding here are identical to trust records that Mozilla is using. The fact that they've also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I've chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn't use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I've chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I've trusted one crate that Mozilla did not: libm, when published by Amanieu. We're trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They've been delta-auditing the newer versions. I've chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[publisher.toml]]
version = "0.5.7"
when = "2020-10-11"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
cargo-vet all remaining dependency bumps
2 years ago
[[publisher.unicode-segmentation]]
version = "1.10.1"
when = "2023-01-31"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.unicode-width]]
version = "0.1.9"
when = "2021-09-16"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
[[publisher.unicode-xid]]
version = "0.2.3"
when = "2022-05-02"
user-id = 1139
user-login = "Manishearth"
user-name = "Manish Goregaokar"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.walkdir]]
version = "2.3.3"
when = "2023-03-16"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.wasi-cap-std-sync]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasi-common]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasi-tokio]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.wasm-bindgen]]
version = "0.2.87"
when = "2023-06-12"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-bindgen-backend]]
version = "0.2.87"
when = "2023-06-12"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-bindgen-macro]]
version = "0.2.87"
when = "2023-06-12"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-bindgen-macro-support]]
version = "0.2.87"
when = "2023-06-12"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-bindgen-shared]]
version = "0.2.87"
when = "2023-06-12"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.wasm-encoder]]
version = "0.30.0"
when = "2023-07-11"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates, disallow empty component types (#6777) * Remove unused WIT files from Wasmtime These files aren't actually read by anything currently. They were added historically and a previous refactoring in #6390 forgot to remove them. No tests or build process reads them so this deletes them to get them out of the way. * Update dependencies on wasm-tools crates. This commit updates the deps on the wasm-tools family of crates to bring in a few fixes for WIT/component-related things. Primarily though this brings in an update to the component model where empty types are now disallowed. Some tests using empty types were adjusted to use non-empty types, but many tests were also simply removed as they existed to test what would happen with empty types which now no longer needs to be tested. * Update `stream-error` in preview2 Add a `dummy` field to make it a non-empty structure. It's expected that this will change to something else more "official" in the future, but for now this is here to keep everything compiling. * Update component fuzzing to avoid empty types Empty types are no longer valid * Update crates/wasi/wit/deps/io/streams.wit Co-authored-by: Peter Huene <peter@huene.dev> --------- Co-authored-by: Peter Huene <peter@huene.dev>
1 year ago
[[publisher.wasm-encoder]]
version = "0.31.1"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.wasm-metadata]]
version = "0.9.0"
when = "2023-07-11"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates, disallow empty component types (#6777) * Remove unused WIT files from Wasmtime These files aren't actually read by anything currently. They were added historically and a previous refactoring in #6390 forgot to remove them. No tests or build process reads them so this deletes them to get them out of the way. * Update dependencies on wasm-tools crates. This commit updates the deps on the wasm-tools family of crates to bring in a few fixes for WIT/component-related things. Primarily though this brings in an update to the component model where empty types are now disallowed. Some tests using empty types were adjusted to use non-empty types, but many tests were also simply removed as they existed to test what would happen with empty types which now no longer needs to be tested. * Update `stream-error` in preview2 Add a `dummy` field to make it a non-empty structure. It's expected that this will change to something else more "official" in the future, but for now this is here to keep everything compiling. * Update component fuzzing to avoid empty types Empty types are no longer valid * Update crates/wasi/wit/deps/io/streams.wit Co-authored-by: Peter Huene <peter@huene.dev> --------- Co-authored-by: Peter Huene <peter@huene.dev>
1 year ago
[[publisher.wasm-metadata]]
version = "0.10.1"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-mutate]]
version = "0.2.30"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasm-smith]]
version = "0.12.13"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.wasmparser]]
version = "0.108.0"
when = "2023-07-11"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates, disallow empty component types (#6777) * Remove unused WIT files from Wasmtime These files aren't actually read by anything currently. They were added historically and a previous refactoring in #6390 forgot to remove them. No tests or build process reads them so this deletes them to get them out of the way. * Update dependencies on wasm-tools crates. This commit updates the deps on the wasm-tools family of crates to bring in a few fixes for WIT/component-related things. Primarily though this brings in an update to the component model where empty types are now disallowed. Some tests using empty types were adjusted to use non-empty types, but many tests were also simply removed as they existed to test what would happen with empty types which now no longer needs to be tested. * Update `stream-error` in preview2 Add a `dummy` field to make it a non-empty structure. It's expected that this will change to something else more "official" in the future, but for now this is here to keep everything compiling. * Update component fuzzing to avoid empty types Empty types are no longer valid * Update crates/wasi/wit/deps/io/streams.wit Co-authored-by: Peter Huene <peter@huene.dev> --------- Co-authored-by: Peter Huene <peter@huene.dev>
1 year ago
[[publisher.wasmparser]]
version = "0.110.0"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wasmprinter]]
version = "0.2.62"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.wasmtime]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-asm-macros]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cache]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cli]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-cli-flags]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-component-macro]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-component-util]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
[[publisher.wasmtime-cranelift]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "11.0.1"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-cranelift-shared]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-environ]]
version = "11.0.1"
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-explorer]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-fiber]]
version = "11.0.1"
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-jit]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-jit-debug]]
version = "11.0.1"
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-jit-icache-coherence]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-runtime]]
version = "11.0.1"
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-types]]
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime's implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&'static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime's dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn't want to implement the wasi-crypto proposal. Instead the "tier 3" status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[publisher.wasmtime-wasi]]
version = "11.0.1"
when = "2023-07-24"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
user-id = 73222
user-login = "wasmtime-publish"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.wasmtime-wasi-http]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi-nn]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wasi-threads]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wast]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-winch]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wasmtime-wit-bindgen]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Update the wasm-tools family of crates, disallow empty component types (#6777) * Remove unused WIT files from Wasmtime These files aren't actually read by anything currently. They were added historically and a previous refactoring in #6390 forgot to remove them. No tests or build process reads them so this deletes them to get them out of the way. * Update dependencies on wasm-tools crates. This commit updates the deps on the wasm-tools family of crates to bring in a few fixes for WIT/component-related things. Primarily though this brings in an update to the component model where empty types are now disallowed. Some tests using empty types were adjusted to use non-empty types, but many tests were also simply removed as they existed to test what would happen with empty types which now no longer needs to be tested. * Update `stream-error` in preview2 Add a `dummy` field to make it a non-empty structure. It's expected that this will change to something else more "official" in the future, but for now this is here to keep everything compiling. * Update component fuzzing to avoid empty types Empty types are no longer valid * Update crates/wasi/wit/deps/io/streams.wit Co-authored-by: Peter Huene <peter@huene.dev> --------- Co-authored-by: Peter Huene <peter@huene.dev>
1 year ago
[[publisher.wast]]
version = "62.0.1"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wat]]
version = "1.0.69"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.wiggle]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wiggle-generate]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
[[publisher.wiggle-macro]]
version = "11.0.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Bump cargo-vet to 0.8.0 (#6642) * Bump cargo-vet to 0.8.0. * Use the new audited-as feature to enable audit-as-crates-io for not-yet-published versions of first-party crates.
1 year ago
[[publisher.wiggle-test]]
version = "0.1.0"
when = "2020-03-12"
user-id = 18162
user-login = "pchickey"
user-name = "Pat Hickey"
Trust crates published by BurntSushi (#6734) This commit adds `cargo vet` trust entries for any crate published by BurntSushi, of which a good number are in our dependency graph. This additionally updates the `bstr` crate to its latest version and updates regex-related dependencies from other crates to avoid duplication of versions.
1 year ago
[[publisher.winapi-util]]
version = "0.1.5"
when = "2020-04-20"
user-id = 189
user-login = "BurntSushi"
user-name = "Andrew Gallant"
Bump Wasmtime to 13.0.0 (#6809) Co-authored-by: Wasmtime Publish <wasmtime-publish@users.noreply.github.com>
1 year ago
[[publisher.winch-codegen]]
version = "0.9.1"
when = "2023-07-24"
user-id = 73222
user-login = "wasmtime-publish"
Replace audits for windows-rs with trusted entries. (#6595) The Bytecode Alliance didn't actually audit these crates but rather simply trusts them, per the notes. Previously we didn't have a way to express this distinction, but now we do.
1 year ago
[[publisher.windows-sys]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows-targets]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_aarch64_gnullvm]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_aarch64_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_i686_gnu]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_i686_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_gnu]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_gnullvm]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
[[publisher.windows_x86_64_msvc]]
version = "0.48.0"
when = "2023-03-31"
user-id = 64539
user-login = "kennykerr"
user-name = "Kenny Kerr"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn't used any more so no need to continue to list this. * Update Wasmtime's pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven't updated from 1.9 to 2.0 that it wasn't possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I've additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime's dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I've additionally added trusted entries for publishes of cap-std crates from Dan. There's still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[publisher.winx]]
version = "0.36.1"
when = "2023-06-29"
user-id = 6825
user-login = "sunfishcode"
user-name = "Dan Gohman"
Update the dev-dependency for wit-bindgen to 0.9.0 (#6800) * Update the dev-dependency for wit-bindgen to 0.9.0 * `new_fields` takes a slice of `String` pairs now
1 year ago
[[publisher.wit-bindgen]]
version = "0.9.0"
when = "2023-07-15"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-core]]
version = "0.9.0"
when = "2023-07-15"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-rust]]
version = "0.9.0"
when = "2023-07-15"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-rust-lib]]
version = "0.9.0"
when = "2023-07-15"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-bindgen-rust-macro]]
version = "0.9.0"
when = "2023-07-15"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[publisher.wit-component]]
version = "0.12.0"
when = "2023-07-11"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates, disallow empty component types (#6777) * Remove unused WIT files from Wasmtime These files aren't actually read by anything currently. They were added historically and a previous refactoring in #6390 forgot to remove them. No tests or build process reads them so this deletes them to get them out of the way. * Update dependencies on wasm-tools crates. This commit updates the deps on the wasm-tools family of crates to bring in a few fixes for WIT/component-related things. Primarily though this brings in an update to the component model where empty types are now disallowed. Some tests using empty types were adjusted to use non-empty types, but many tests were also simply removed as they existed to test what would happen with empty types which now no longer needs to be tested. * Update `stream-error` in preview2 Add a `dummy` field to make it a non-empty structure. It's expected that this will change to something else more "official" in the future, but for now this is here to keep everything compiling. * Update component fuzzing to avoid empty types Empty types are no longer valid * Update crates/wasi/wit/deps/io/streams.wit Co-authored-by: Peter Huene <peter@huene.dev> --------- Co-authored-by: Peter Huene <peter@huene.dev>
1 year ago
[[publisher.wit-component]]
version = "0.13.1"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
[[publisher.wit-parser]]
version = "0.9.2"
when = "2023-07-26"
user-id = 1
user-login = "alexcrichton"
user-name = "Alex Crichton"
Update the wasm-tools family of crates (#6710) * Update wasm-tools dependencies * Get tests passing after wasm-tools update Mostly dealing with updates to `wasmparser`'s API. * Update `cargo vet` for new crates * Add `equivalent`, `hashbrown`, and `quote` to the list of trusted authors. We already trust these authors for other crates. * Pull in some upstream audits for various deps. * I've audited the `pulldown-cmark` dependency upgrade myself.
1 year ago
[[audits.embark-studios.wildcard-audits.spdx]]
who = "Jake Shadle <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
user-id = 52553 # embark-studios
start = "2020-01-01"
end = "2024-05-23"
notes = "Maintained by Embark. No unsafe usage or ambient capabilities"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
[[audits.embark-studios.audits.anyhow]]
who = "Johan Andersson <opensource@embark-studios.com>"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
criteria = "safe-to-deploy"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
version = "1.0.58"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn&#39;t used any more so no need to continue to list this. * Update Wasmtime&#39;s pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven&#39;t updated from 1.9 to 2.0 that it wasn&#39;t possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I&#39;ve additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime&#39;s dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I&#39;ve additionally added trusted entries for publishes of cap-std crates from Dan. There&#39;s still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[audits.embark-studios.audits.colorchoice]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "1.0.0"
notes = "No unsafe usage or ambient capabilities"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
[[audits.embark-studios.audits.cty]]
who = "Johan Andersson <opensource@embark-studios.com>"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
criteria = "safe-to-deploy"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
version = "0.2.2"
notes = "Inspected it and is a tiny crate with just type definitions"
Bump cargo-vet to 0.7.0 (#6544) * Bump cargo-vet to 0.7.0. * Prune exemptions. * Import fermyon.
1 year ago
[[audits.embark-studios.audits.ittapi]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.3.3"
notes = "Lots of unsafe code for calling into C FFI functions, looks pretty simple and sound though. No ambient capabilities"
[[audits.embark-studios.audits.ittapi-sys]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.3.3"
notes = """
Builds C/asm dependency which this review has not audited in detail, but is well established from Intel.
Exposes FFI types & functions generated through bindgen. No other logic.
No ambient capabilities
"""
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn&#39;t used any more so no need to continue to list this. * Update Wasmtime&#39;s pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven&#39;t updated from 1.9 to 2.0 that it wasn&#39;t possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I&#39;ve additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime&#39;s dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I&#39;ve additionally added trusted entries for publishes of cap-std crates from Dan. There&#39;s still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[audits.embark-studios.audits.utf8parse]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.2.1"
notes = "Single unsafe usage that looks sound, no ambient capabilities"
add supply chain audits for #5929&#39;s rustls changes (#6137) The `ring` crate needed to be exempted: it contains a large quantity of asm and native binary implementations of crypto primitives. It is a major undertaking to certify the safety of those implementations. ring also pulled in the wasm-bindgen family of crates for its wasm32-unknown-unknown target, which this project will not be using. Because we don&#39;t care about that platform, I added exemptions for all of these crates, so we don&#39;t have to audit them. The actual supply chain audits for rusttls, rustls-webpki, sct, and tokio-rustls were unremarkable. I also audited a small diff on wasm-bindgen-shared because it was trivial.
2 years ago
[[audits.embark-studios.audits.webpki-roots]]
who = "Johan Andersson <opensource@embark-studios.com>"
criteria = "safe-to-deploy"
version = "0.22.4"
notes = "Inspected it to confirm that it only contains data definitions and no runtime code"
Bump cargo-vet to 0.7.0 (#6544) * Bump cargo-vet to 0.7.0. * Prune exemptions. * Import fermyon.
1 year ago
[[audits.fermyon.audits.oorandom]]
who = "Radu Matei <radu.matei@fermyon.com>"
criteria = "safe-to-run"
version = "11.1.3"
Update a few dependencies to pull in `cargo vet` entries (#6247) This trims down the `[exemptions]` list ever-so-slightly by following the suggestions of `cargo vet suggest` and updating a few crates across some minor versions.
2 years ago
[[audits.google.audits.fastrand]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "1.9.0"
notes = """
`does-not-implement-crypto` is certified because this crate explicitly says
that the RNG here is not cryptographically secure.
"""
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
Audit some of the cargo vet backlog (#6536) Joint session between myself, pchickey, elliottt, itsrainy, and fitzgen.
1 year ago
[[audits.google.audits.glob]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "0.3.1"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
Bump cargo-vet to 0.6.1 (#6110) * Bump cargo-vet to 0.6.1. * Add Fuchsia and prune.
2 years ago
[[audits.google.audits.libfuzzer-sys]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "0.4.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime&#39;s implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&amp;&#39;static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime&#39;s dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn&#39;t want to implement the wasi-crypto proposal. Instead the &#34;tier 3&#34; status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[audits.google.audits.pin-project-lite]]
who = "David Koloski <dkoloski@google.com>"
cargo-vet all remaining dependency bumps
2 years ago
criteria = "safe-to-deploy"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime&#39;s implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&amp;&#39;static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime&#39;s dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn&#39;t want to implement the wasi-crypto proposal. Instead the &#34;tier 3&#34; status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
version = "0.2.9"
notes = "Reviewed on https://fxrev.dev/824504"
aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
cargo-vet all remaining dependency bumps
2 years ago
Bump cargo-vet to 0.6.1 (#6110) * Bump cargo-vet to 0.6.1. * Add Fuchsia and prune.
2 years ago
[[audits.google.audits.static_assertions]]
who = "ChromeOS"
criteria = "safe-to-run"
version = "1.1.0"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
[[audits.google.audits.version_check]]
who = "George Burgess IV <gbiv@google.com>"
criteria = "safe-to-deploy"
version = "0.9.4"
aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/main/cargo-vet/audits.toml?format=TEXT"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
[[audits.isrg.audits.block-buffer]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.9.0"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn&#39;t used any more so no need to continue to list this. * Update Wasmtime&#39;s pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven&#39;t updated from 1.9 to 2.0 that it wasn&#39;t possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I&#39;ve additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime&#39;s dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I&#39;ve additionally added trusted entries for publishes of cap-std crates from Dan. There&#39;s still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[audits.isrg.audits.criterion]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.4.0 -> 0.5.1"
Update v8 and proc-macro2 dependencies (#6680) * Update v8 and proc-macro2 dependencies Gets them both compiling on the latest nightly so we can unpin the Rust compiler version in OSS-Fuzz. * Update nightly in CI
1 year ago
[[audits.isrg.audits.once_cell]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.17.1 -> 1.17.2"
[[audits.isrg.audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.17.2 -> 1.18.0"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime&#39;s implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&amp;&#39;static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime&#39;s dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn&#39;t want to implement the wasi-crypto proposal. Instead the &#34;tier 3&#34; status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[audits.isrg.audits.rand_core]]
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime&#39;s implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&amp;&#39;static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime&#39;s dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn&#39;t want to implement the wasi-crypto proposal. Instead the &#34;tier 3&#34; status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
version = "0.6.3"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime&#39;s implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&amp;&#39;static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime&#39;s dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn&#39;t want to implement the wasi-crypto proposal. Instead the &#34;tier 3&#34; status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
[[audits.isrg.audits.sha2]]
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
Remove the implementation of wasi-crypto (#6816) * Remove the implementation of wasi-crypto This commit is a follow-up to the discussion on #6732. This removes Wasmtime&#39;s implementation of the wasi-crypto proposal from in-tree along with its various support in CI, configuration, etc. See the discussion on #6732 for the full information but at a high level the main reasons for removing the implementation at this time are: * There is not currently an active maintainer of the Wasmtime integration here for wasi-crypto. * There are known issues with the code quality of the implementation such as transmutes of guest-owned memory to `&amp;&#39;static mut [u8]` and known unsafety in dependencies. * The size and breadth of the dependency tree brings maintenance burden and overhead to managing Wasmtime&#39;s dependency tree. As mentioned on the issue this commit does not mean that Wasmtime doesn&#39;t want to implement the wasi-crypto proposal. Instead the &#34;tier 3&#34; status of wasi-crypto needs to be re-attained to be included back in-tree, which would mean resolving the above issues. Note that this commit is intentionally just after the 13.0.0 branch point which means that this is slated for Wasmtime 14 to be released on September 20. * Remove some cfgs * Remove wasi-crypto CI
1 year ago
version = "0.10.2"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
add supply chain audits for #5929&#39;s rustls changes (#6137) The `ring` crate needed to be exempted: it contains a large quantity of asm and native binary implementations of crypto primitives. It is a major undertaking to certify the safety of those implementations. ring also pulled in the wasm-bindgen family of crates for its wasm32-unknown-unknown target, which this project will not be using. Because we don&#39;t care about that platform, I added exemptions for all of these crates, so we don&#39;t have to audit them. The actual supply chain audits for rusttls, rustls-webpki, sct, and tokio-rustls were unremarkable. I also audited a small diff on wasm-bindgen-shared because it was trivial.
2 years ago
[[audits.isrg.audits.untrusted]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.7.1"
cargo-vet all remaining dependency bumps
2 years ago
[[audits.mozilla.wildcard-audits.unicode-segmentation]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
Bump cargo-vet to 0.7.0 (#6544) * Bump cargo-vet to 0.7.0. * Prune exemptions. * Import fermyon.
1 year ago
user-id = 1139 # Manish Goregaokar (Manishearth)
cargo-vet all remaining dependency bumps
2 years ago
start = "2019-05-15"
end = "2024-05-03"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.wildcard-audits.unicode-width]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
Bump cargo-vet to 0.7.0 (#6544) * Bump cargo-vet to 0.7.0. * Prune exemptions. * Import fermyon.
1 year ago
user-id = 1139 # Manish Goregaokar (Manishearth)
cargo-vet all remaining dependency bumps
2 years ago
start = "2019-12-05"
end = "2024-05-03"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.wildcard-audits.unicode-xid]]
who = "Manish Goregaokar <manishsmail@gmail.com>"
criteria = "safe-to-deploy"
Bump cargo-vet to 0.7.0 (#6544) * Bump cargo-vet to 0.7.0. * Prune exemptions. * Import fermyon.
1 year ago
user-id = 1139 # Manish Goregaokar (Manishearth)
cargo-vet all remaining dependency bumps
2 years ago
start = "2019-07-25"
end = "2024-05-03"
notes = "All code written or reviewed by Manish"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.57 -> 1.0.61"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
delta = "1.0.58 -> 1.0.57"
notes = "No functional differences, just CI config and docs."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.61 -> 1.0.62"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.62 -> 1.0.68"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.anyhow]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.68 -> 1.0.69"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update wasm-tools dependencies (#4970) * Update wasm-tools dependencies This update brings in a number of features such as: * The component model binary format and AST has been slightly adjusted in a few locations. Names are dropped from parameters/results now in the internal representation since they were not used anyway. At this time the ability to bind a multi-return function has not been exposed. * The `wasmparser` validator pass will now share allocations with prior functions, providing what&#39;s probably a very minor speedup for Wasmtime itself. * The text format for many component-related tests now requires named parameters. * Some new relaxed-simd instructions are updated to be ignored. I hope to have a follow-up to expose the multi-return ability to the embedding API of components. * Update audit information for new crates
2 years ago
[[audits.mozilla.audits.autocfg]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "All code written or reviewed by Josh Stone."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update wasm-tools dependencies (#4970) * Update wasm-tools dependencies This update brings in a number of features such as: * The component model binary format and AST has been slightly adjusted in a few locations. Names are dropped from parameters/results now in the internal representation since they were not used anyway. At this time the ability to bind a multi-return function has not been exposed. * The `wasmparser` validator pass will now share allocations with prior functions, providing what&#39;s probably a very minor speedup for Wasmtime itself. * The text format for many component-related tests now requires named parameters. * Some new relaxed-simd instructions are updated to be ignored. I hope to have a follow-up to expose the multi-return ability to the embedding API of components. * Update audit information for new crates
2 years ago
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.bit-set]]
who = "Aria Beingessner <a.beingessner@gmail.com>"
criteria = "safe-to-deploy"
version = "0.5.2"
notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.bit-vec]]
who = "Aria Beingessner <a.beingessner@gmail.com>"
criteria = "safe-to-deploy"
version = "0.6.3"
notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
`cargo vet` audits for guest profiling support (#6284) These audits are necessary for in-process guest profiling support, currently under development in PR #6282.
2 years ago
[[audits.mozilla.audits.bitflags]]
who = "Alex Franchuk <afranchuk@mozilla.com>"
criteria = "safe-to-deploy"
delta = "1.3.2 -> 2.0.2"
notes = "Removal of some unsafe code/methods. No changes to externals, just some refactoring (mostly internal)."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bitflags]]
who = "Nicolas Silva <nical@fastmail.com>"
criteria = "safe-to-deploy"
delta = "2.0.2 -> 2.1.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Dependency gardening for Wasmtime (#6731) * Remove deny.toml exception for wasm-coredump-builder This isn&#39;t used any more so no need to continue to list this. * Update Wasmtime&#39;s pretty_env_logger dependency This removes a `deny.toml` exception for that crate, but `openvino-sys` still depends on `pretty_env_logger 0.4.0` so a new exception is added for that. * Update criterion and clap dependencies This commit started out by updating the `criterion` dependency to remove an entry in `deny.toml`, but that ended up transitively requiring a `clap` dependency upgrade from 3.x to 4.x because `criterion` uses pieces of clap 4.x. Most of this commit is then dedicated to updating clap 3.x to 4.x which was relatively simple, mostly renaming attributes here and there. * Update gimli-related dependencies I originally wanted to remove the `indexmap` clause in `deny.toml` but enough dependencies haven&#39;t updated from 1.9 to 2.0 that it wasn&#39;t possible. In the meantime though this updates some various dependencies to bring them to the latest and a few of them now use `indexmap` 2.0. * Update deps to remove `windows-sys 0.45.0` This involved updating tokio/mio and then providing new audits for new crates. The tokio exemption was updated from its old version to the new version and tokio remains un-audited. * Update `syn` to 2.x.x This required a bit of rewriting for the component-macro related bits but otherwise was pretty straightforward. The `syn` 1.x.x track is still present in the wasi-crypto tree at this time. I&#39;ve additionally added some trusted audits for my own publications of `wasm-bindgen` * Update bitflags to 2.x.x This updates Wasmtime&#39;s dependency on the `bitflags` crate to the 2.x.x track to keep it up-to-date. * Update the cap-std family of crates This bumps them all to the next major version to keep up with updates. I&#39;ve additionally added trusted entries for publishes of cap-std crates from Dan. There&#39;s still lingering references to rustix 0.37.x which will need to get weeded out over time. * Update memoffset dependency to latest Avoids having two versions in our crate graph. * Fix tests * Update try_from for wiggle flags * Fix build on AArch64 Linux * Enable `event` for rustix on Windows too
1 year ago
[[audits.mozilla.audits.bitflags]]
who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
criteria = "safe-to-deploy"
delta = "2.2.1 -> 2.3.2"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
WASI Preview 2: rewrite streams and pollable implementation (#6556) * preview2: make everything but streams/io and poll/poll synchronous * streams: get rid of as_any method, which is no longer used * delete legacy sched and pollable concepts * more code motion and renaming * make tokio a workspace dep, because we need it directly in wasmtime-wasi * HostPollable exists * more fixes * pollable can trap, and implement clock properly * HostPollable is now a generator of futures because we need to be able to poll a pollable many times * explain various todo!s * Synchronous version of the wasi-preview2-components tests * Change with_tokio to accept the future as an argument * Store futures in the PollOneoff struct instead, to avoid dropping them * Remove TODO for HostOutputStream impl for WritePipe * Implement pollable for ReadPipe * Use a Notify when ReadPipe is ready * wip * wip * Read/write pipe ends with tokio channels * Empty reader/writer wrappers * EmptyStream, and warning cleanup * Wrapped reader/writer structs * Rework stdio in terms of wrapped read/write * Add MemoryOutputPipe and update tests * Remove todo * rewrite nearly everything * implement the pipe stuff * wibble * fix MemoryOutputPipe just enough to make the tests compile * Move the table iteration into a helper function * AsyncFd stream implementation to fix stdin on unix * Rename Wrapped{Read,Write} streams to Async{Read,Write}Stream * Move async io wrappers into stream.rs * Fix the sync tests * fix test uses of pipes, juggle tokio context for stdin construction * add some fixmes * the future i named Never is defined in futures-util as pending which is a better name * i believe this is a correct implementation of one global stdin resource * move unix stdin to its own file * make most of the mods private * fix build - we are skipping rust 1.70 due to llvm regressions in s390x and riscv64 which are fixed in 1.71 and will not be backported * preview1-in-preview2: use async funcs for io, and the async io interface prtest:full * windows stdin support * done! * table ext functions: fix tests * tests: expect poll_oneoff_{files,stdio} to pass on all platforms * export the bindings under wasmtime_wasi::preview2::bindings rather than preview2::wasi. and command moves to wasmtime_wasi::preview2::command as well. * fix renaming of wasi to bindings in tests * use block_in_place throughout filesystem and move block_on and block_in_place to be pub crate at the root * AsyncFdStream: ensure file is nonblocking * tests: block_in_place requires multi-threaded runtime * actually, use fcntl_setfl to make the asyncfd file nonblocking * fix windows block_on * docs, remove unnecessary methods * more docs * Add a workspace dependency on bytes-1.4 * Remove vectored stream operations * Rework the read/write stream traits * Add a size parameter to `read`, and switch to usize for traits * Pipe through the bool -&gt; stream-status change in wit * Plumb stream-status through write operations in wit * write host trait also gives streamstate * hook new stream host read/write back up to the wit bindgen * sketchy AsyncReadStream impl * Fill out implementations for AsyncReadStream and AsyncWriteStream * some reasonable read tests * more * first smoke test for AsyncWriteStream * bunch of AsyncWriteStream tests * half-baked idea that the output-stream interface will need a flush mechanism * adapter: fixes for changes to stream wit * fix new rust 1.71 warnings * make stdin work on unix without using AsyncFdStream inline the tokio docs example of how to impl AsyncRead for an AsyncFd, except theres some &#34;minor&#34; changes because stdin doesnt impl Read on &amp;Stdin whereas tcpstream from the example does * delete AsyncFdStream for now it turns out to be kinda hard and we can always work on adding it back in later. * Implement some memory pipe operations, and move async wrappers to the pipe mod * Make blocking_write actually block until everything is written * Remove debug print * Adapter stdio should use blocking write Rust guests will panic if the write returns less than the number of bytes sent with stdio. * Clean up implementations of {blocking_}write_zeros and skip * Remove debug macro usage * Move EmptyStream to pipe, and split it into four variants Use EmptyInputStream and SinkOutputStream as the defaults for stdin and stdout/stderr respectively. * Add a big warning about resource lifetime tracking in pollables * Start working through changes to the filesystem implementation * Remove todos in the filesystem implementation * Avoid lifetime errors by moving blocking operations to File and Dir * Fix more lifetime issues with `block` * Finish filling out translation impl * fix warnings * we can likely eliminate block_in_place in the stdin implementations * sync command uses sync filesystem, start of translation layer * symc filesystem: all the trait boilerplate is in place just need to finish the from impl boilerplate * finish type conversion boilerplate * Revert &#34;half-baked idea that the output-stream interface will need a flush mechanism&#34; This reverts commit 3eb762e3330a7228318bfe01296483b52d0fdc16. * cargo fmt * test type fixes * renames and comments * refactor stream table internals so we can have a blocking variant... * preview1 host adapter: stdout/stderr use blocking_write here too * filesystem streams are blocking now * fixes * satisfy cargo doc * cargo vet: dep upgrades taken care of by imports from mozilla * unix stdio: eliminate block_in_place * replace private in_tokio with spawn, since its only used for spawning * comments * worker thread stdin implementation can be tested on linux, i guess and start outlining a test plan * eliminate tokio boilerplate - no longer using tokios lock * rename our private block_on to in_tokio * fill in missing file input skip * code review: fix MemoryInputPipe. Closed status is always available immediately. * code review: empty input stream is not essential, closed input stream is a better fi for stdin * code review: unreachable * turn worker thread (windows) stdin off * expect preview2-based poll_oneoff_stdio to fail on windows * command directory_list test: no need to inherit stdin * preview1 in preview2: turn off inherit_stdio except for poll_oneoff_stdio * wasi-preview2-components: apparently inherit_stdio was on everywhere here as well. turn it off except for poll_oneoff_stdio * extend timeout for riscv64 i suppose --------- Co-authored-by: Trevor Elliott &lt;telliott@fastly.com&gt;
1 year ago
[[audits.mozilla.audits.bytes]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.1.0 -> 1.2.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bytes]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.2.1 -> 1.3.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.bytes]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.3.0 -> 1.4.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Upgrade sha2 to 0.10.2 in wasmtime (#4749)
2 years ago
[[audits.mozilla.audits.crypto-common]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.3 -> 0.1.6"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
wasmtime: In-process sampling profiler (#6282) * wasmtime: In-process sampling profiler Unlike the existing profiling options, this works on all platforms and does not rely on any external profiling tools like perf or VTune. On the other hand, it can only profile time spent in the WebAssembly guest, not in Wasmtime itself or other host code. Also it can&#39;t measure time as precisely as platform-native tools can. The profile is saved in the Firefox processed format, which can be viewed using https://profiler.firefox.com/. * Ensure func_offset is populated * Refactor * Review comments * Move GuestProfiler to the wasmtime crate * Document the new GuestProfiler API * Add TODO comments for future work * Use module_offset, not func_offset, as fallback PC * Minimize work done during `sample()` Use fxprof_processed_profile&#39;s support for looking up symbols to avoid looking up the same PC more than once per profile. * Keep profiler state in the store Also extend the documentation based on review comments. * Import debugid audit from Mozilla again
2 years ago
[[audits.mozilla.audits.debugid]]
who = "Gabriele Svelto <gsvelto@mozilla.com>"
criteria = "safe-to-deploy"
version = "0.8.0"
notes = "This crates was written by Sentry and I've fully audited it as Firefox crash reporting machinery relies on it."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
[[audits.mozilla.audits.either]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.6.1"
notes = """
Straightforward crate providing the Either enum and trait implementations with
no unsafe code.
"""
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
Upgrade sha2 to 0.10.2 in wasmtime (#4749)
2 years ago
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.encoding_rs]]
who = "Henri Sivonen <hsivonen@hsivonen.fi>"
criteria = "safe-to-deploy"
version = "0.8.31"
notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
Update several dependencies. (#6171) This updates to rustix 0.37.13, which contains some features we can use to implement more features in wasi-common for the wasi-sockets API. This also pulls in several other updates to avoid having multiple versions of rustix. This does introduce multiple versions of windows-sys, as the errno and tokio crates are currently using 0.45 while rustix and other dependencies have updated to 0.48; PRs updating these are already in flight so this will hopefully be resolved soon. It also includes cap-std 1.0.14, which disables the use of `openat2` and `statx` on Android, fixing a bug where some Android devices crash the process when those syscalls are executed.
2 years ago
[[audits.mozilla.audits.env_logger]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.9.0 -> 0.9.3"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.env_logger]]
who = "Nicolas Silva <nical@fastmail.com>"
criteria = "safe-to-deploy"
delta = "0.9.3 -> 0.10.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.flagset]]
who = "Ryan Hunt <rhunt@eqrion.net>"
criteria = "safe-to-deploy"
version = "0.4.3"
notes = "Uses no ambient capabilities, vetted the one instance of unsafe."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.fnv]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "1.0.7"
notes = "Simple hasher implementation with no unsafe code."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
WASI Preview 2: rewrite streams and pollable implementation (#6556) * preview2: make everything but streams/io and poll/poll synchronous * streams: get rid of as_any method, which is no longer used * delete legacy sched and pollable concepts * more code motion and renaming * make tokio a workspace dep, because we need it directly in wasmtime-wasi * HostPollable exists * more fixes * pollable can trap, and implement clock properly * HostPollable is now a generator of futures because we need to be able to poll a pollable many times * explain various todo!s * Synchronous version of the wasi-preview2-components tests * Change with_tokio to accept the future as an argument * Store futures in the PollOneoff struct instead, to avoid dropping them * Remove TODO for HostOutputStream impl for WritePipe * Implement pollable for ReadPipe * Use a Notify when ReadPipe is ready * wip * wip * Read/write pipe ends with tokio channels * Empty reader/writer wrappers * EmptyStream, and warning cleanup * Wrapped reader/writer structs * Rework stdio in terms of wrapped read/write * Add MemoryOutputPipe and update tests * Remove todo * rewrite nearly everything * implement the pipe stuff * wibble * fix MemoryOutputPipe just enough to make the tests compile * Move the table iteration into a helper function * AsyncFd stream implementation to fix stdin on unix * Rename Wrapped{Read,Write} streams to Async{Read,Write}Stream * Move async io wrappers into stream.rs * Fix the sync tests * fix test uses of pipes, juggle tokio context for stdin construction * add some fixmes * the future i named Never is defined in futures-util as pending which is a better name * i believe this is a correct implementation of one global stdin resource * move unix stdin to its own file * make most of the mods private * fix build - we are skipping rust 1.70 due to llvm regressions in s390x and riscv64 which are fixed in 1.71 and will not be backported * preview1-in-preview2: use async funcs for io, and the async io interface prtest:full * windows stdin support * done! * table ext functions: fix tests * tests: expect poll_oneoff_{files,stdio} to pass on all platforms * export the bindings under wasmtime_wasi::preview2::bindings rather than preview2::wasi. and command moves to wasmtime_wasi::preview2::command as well. * fix renaming of wasi to bindings in tests * use block_in_place throughout filesystem and move block_on and block_in_place to be pub crate at the root * AsyncFdStream: ensure file is nonblocking * tests: block_in_place requires multi-threaded runtime * actually, use fcntl_setfl to make the asyncfd file nonblocking * fix windows block_on * docs, remove unnecessary methods * more docs * Add a workspace dependency on bytes-1.4 * Remove vectored stream operations * Rework the read/write stream traits * Add a size parameter to `read`, and switch to usize for traits * Pipe through the bool -&gt; stream-status change in wit * Plumb stream-status through write operations in wit * write host trait also gives streamstate * hook new stream host read/write back up to the wit bindgen * sketchy AsyncReadStream impl * Fill out implementations for AsyncReadStream and AsyncWriteStream * some reasonable read tests * more * first smoke test for AsyncWriteStream * bunch of AsyncWriteStream tests * half-baked idea that the output-stream interface will need a flush mechanism * adapter: fixes for changes to stream wit * fix new rust 1.71 warnings * make stdin work on unix without using AsyncFdStream inline the tokio docs example of how to impl AsyncRead for an AsyncFd, except theres some &#34;minor&#34; changes because stdin doesnt impl Read on &amp;Stdin whereas tcpstream from the example does * delete AsyncFdStream for now it turns out to be kinda hard and we can always work on adding it back in later. * Implement some memory pipe operations, and move async wrappers to the pipe mod * Make blocking_write actually block until everything is written * Remove debug print * Adapter stdio should use blocking write Rust guests will panic if the write returns less than the number of bytes sent with stdio. * Clean up implementations of {blocking_}write_zeros and skip * Remove debug macro usage * Move EmptyStream to pipe, and split it into four variants Use EmptyInputStream and SinkOutputStream as the defaults for stdin and stdout/stderr respectively. * Add a big warning about resource lifetime tracking in pollables * Start working through changes to the filesystem implementation * Remove todos in the filesystem implementation * Avoid lifetime errors by moving blocking operations to File and Dir * Fix more lifetime issues with `block` * Finish filling out translation impl * fix warnings * we can likely eliminate block_in_place in the stdin implementations * sync command uses sync filesystem, start of translation layer * symc filesystem: all the trait boilerplate is in place just need to finish the from impl boilerplate * finish type conversion boilerplate * Revert &#34;half-baked idea that the output-stream interface will need a flush mechanism&#34; This reverts commit 3eb762e3330a7228318bfe01296483b52d0fdc16. * cargo fmt * test type fixes * renames and comments * refactor stream table internals so we can have a blocking variant... * preview1 host adapter: stdout/stderr use blocking_write here too * filesystem streams are blocking now * fixes * satisfy cargo doc * cargo vet: dep upgrades taken care of by imports from mozilla * unix stdio: eliminate block_in_place * replace private in_tokio with spawn, since its only used for spawning * comments * worker thread stdin implementation can be tested on linux, i guess and start outlining a test plan * eliminate tokio boilerplate - no longer using tokios lock * rename our private block_on to in_tokio * fill in missing file input skip * code review: fix MemoryInputPipe. Closed status is always available immediately. * code review: empty input stream is not essential, closed input stream is a better fi for stdin * code review: unreachable * turn worker thread (windows) stdin off * expect preview2-based poll_oneoff_stdio to fail on windows * command directory_list test: no need to inherit stdin * preview1 in preview2: turn off inherit_stdio except for poll_oneoff_stdio * wasi-preview2-components: apparently inherit_stdio was on everywhere here as well. turn it off except for poll_oneoff_stdio * extend timeout for riscv64 i suppose --------- Co-authored-by: Trevor Elliott &lt;telliott@fastly.com&gt;
1 year ago
[[audits.mozilla.audits.futures-io]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.3.27 -> 0.3.28"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.fxhash]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "0.2.1"
notes = "Straightforward crate with no unsafe code, does what it says on the tin."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
vet: update to getrandom crate is covered by imports
1 year ago
[[audits.mozilla.audits.getrandom]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.6 -> 0.2.7"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.getrandom]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.2.7 -> 0.2.8"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.getrandom]]
who = "Yannis Juglaret <yjuglaret@mozilla.com>"
criteria = "safe-to-deploy"
delta = "0.2.8 -> 0.2.9"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Add a `wasmtime::component::bindgen!` macro (#5317) * Import Wasmtime support from the `wit-bindgen` repo This commit imports the `wit-bindgen-gen-host-wasmtime-rust` crate from the `wit-bindgen` repository into the upstream Wasmtime repository. I&#39;ve chosen to not import the full history here since the crate is relatively small and doesn&#39;t have a ton of complexity. While the history of the crate is quite long the current iteration of the crate&#39;s history is relatively short so there&#39;s not a ton of import there anyway. The thinking is that this can now continue to evolve in-tree. * Refactor `wasmtime-component-macro` a bit Make room for a `wit_bindgen` macro to slot in. * Add initial support for a `bindgen` macro * Add tests for `wasmtime::component::bindgen!` * Improve error forgetting `async` feature * Add end-to-end tests for bindgen * Add an audit of `unicase` * Add a license to the test-helpers crate * Add vet entry for `pulldown-cmark` * Update publish script with new crate * Try to fix publish script * Update audits * Update lock file
2 years ago
[[audits.mozilla.audits.half]]
who = "John M. Schanck <jschanck@mozilla.com>"
criteria = "safe-to-deploy"
version = "1.8.2"
notes = """
This crate contains unsafe code for bitwise casts to/from binary16 floating-point
format. I've reviewed these and found no issues. There are no uses of ambient
capabilities.
"""
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Add a `wasmtime::component::bindgen!` macro (#5317) * Import Wasmtime support from the `wit-bindgen` repo This commit imports the `wit-bindgen-gen-host-wasmtime-rust` crate from the `wit-bindgen` repository into the upstream Wasmtime repository. I&#39;ve chosen to not import the full history here since the crate is relatively small and doesn&#39;t have a ton of complexity. While the history of the crate is quite long the current iteration of the crate&#39;s history is relatively short so there&#39;s not a ton of import there anyway. The thinking is that this can now continue to evolve in-tree. * Refactor `wasmtime-component-macro` a bit Make room for a `wit_bindgen` macro to slot in. * Add initial support for a `bindgen` macro * Add tests for `wasmtime::component::bindgen!` * Improve error forgetting `async` feature * Add end-to-end tests for bindgen * Add an audit of `unicase` * Add a license to the test-helpers crate * Add vet entry for `pulldown-cmark` * Update publish script with new crate * Try to fix publish script * Update audits * Update lock file
2 years ago
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.hashbrown]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
version = "0.12.3"
notes = "This version is used in rust's libstd, so effectively we're already trusting it"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
Add vet entries for coredump support (#5878) * Update the `num_cpus` crate Audits for this update provided from our import from Mozilla. * Add vet entries for coredump support
2 years ago
[[audits.mozilla.audits.hermit-abi]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.19 -> 0.2.6"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.lazy_static]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.4.0"
notes = "I have read over the macros, and audited the unsafe code."
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
Add vet entries for coredump support (#5878) * Update the `num_cpus` crate Audits for this update provided from our import from Mozilla. * Add vet entries for coredump support
2 years ago
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.log]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
version = "0.4.17"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
Add cargo-vet entries for dependency update (#5778) This adds vet entries for the updates being performed in #5513
2 years ago
[[audits.mozilla.audits.memoffset]]
who = "Gabriele Svelto <gsvelto@mozilla.com>"
criteria = "safe-to-deploy"
delta = "0.6.5 -> 0.7.1"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Add cargo-vet entries for dependency update (#5778) This adds vet entries for the updates being performed in #5513
2 years ago
Update wasm-tools dependencies (#4970) * Update wasm-tools dependencies This update brings in a number of features such as: * The component model binary format and AST has been slightly adjusted in a few locations. Names are dropped from parameters/results now in the internal representation since they were not used anyway. At this time the ability to bind a multi-return function has not been exposed. * The `wasmparser` validator pass will now share allocations with prior functions, providing what&#39;s probably a very minor speedup for Wasmtime itself. * The text format for many component-related tests now requires named parameters. * Some new relaxed-simd instructions are updated to be ignored. I hope to have a follow-up to expose the multi-return ability to the embedding API of components. * Update audit information for new crates
2 years ago
[[audits.mozilla.audits.num-traits]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "0.2.15"
notes = "All code written or reviewed by Josh Stone."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update wasm-tools dependencies (#4970) * Update wasm-tools dependencies This update brings in a number of features such as: * The component model binary format and AST has been slightly adjusted in a few locations. Names are dropped from parameters/results now in the internal representation since they were not used anyway. At this time the ability to bind a multi-return function has not been exposed. * The `wasmparser` validator pass will now share allocations with prior functions, providing what&#39;s probably a very minor speedup for Wasmtime itself. * The text format for many component-related tests now requires named parameters. * Some new relaxed-simd instructions are updated to be ignored. I hope to have a follow-up to expose the multi-return ability to the embedding API of components. * Update audit information for new crates
2 years ago
Add vet entries for coredump support (#5878) * Update the `num_cpus` crate Audits for this update provided from our import from Mozilla. * Add vet entries for coredump support
2 years ago
[[audits.mozilla.audits.num_cpus]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.13.1 -> 1.14.0"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Add vet entries for coredump support (#5878) * Update the `num_cpus` crate Audits for this update provided from our import from Mozilla. * Add vet entries for coredump support
2 years ago
[[audits.mozilla.audits.num_cpus]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.14.0 -> 1.15.0"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Add vet entries for coredump support (#5878) * Update the `num_cpus` crate Audits for this update provided from our import from Mozilla. * Add vet entries for coredump support
2 years ago
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
[[audits.mozilla.audits.once_cell]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.12.0 -> 1.13.1"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Import cargo-vet audits from Mozilla (#4792) * Bump cargo-vet to 0.3. * Add Mozilla as a trusted import for audits.
2 years ago
Add cargo-vet updates for audit backlog. (#5708)
2 years ago
[[audits.mozilla.audits.once_cell]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.13.1 -> 1.16.0"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Add cargo-vet updates for audit backlog. (#5708)
2 years ago
Update v8 and proc-macro2 dependencies (#6680) * Update v8 and proc-macro2 dependencies Gets them both compiling on the latest nightly so we can unpin the Rust compiler version in OSS-Fuzz. * Update nightly in CI
1 year ago
[[audits.mozilla.audits.once_cell]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.16.0 -> 1.17.1"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
cargo-vet all remaining dependency bumps
2 years ago
[[audits.mozilla.audits.proc-macro2]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "1.0.39"
notes = """
`proc-macro2` acts as either a thin(-ish) wrapper around the std-provided
`proc_macro` crate, or as a fallback implementation of the crate, depending on
where it is used.
If using this crate on older versions of rustc (1.56 and earlier), it will
temporarily replace the panic handler while initializing in order to detect if
it is running within a `proc_macro`, which could lead to surprising behaviour.
This should not be an issue for more recent compiler versions, which support
`proc_macro::is_available()`.
The `proc-macro2` crate's fallback behaviour is not identical to the complex
behaviour of the rustc compiler (e.g. it does not perform unicode normalization
for identifiers), however it behaves well enough for its intended use-case
(tests and scripts processing rust code).
`proc-macro2` does not use unsafe code, however exposes one `unsafe` API to
allow bypassing checks in the fallback implementation when constructing
`Literal` using `from_str_unchecked`. This was intended to only be used by the
`quote!` macro, however it has been removed
(https://github.com/dtolnay/quote/commit/f621fe64a8a501cae8e95ebd6848e637bbc79078),
and is likely completely unused. Even when used, this API shouldn't be able to
cause unsoundness.
"""
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.39 -> 1.0.43"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.43 -> 1.0.49"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.proc-macro2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "1.0.49 -> 1.0.51"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update v8 and proc-macro2 dependencies (#6680) * Update v8 and proc-macro2 dependencies Gets them both compiling on the latest nightly so we can unpin the Rust compiler version in OSS-Fuzz. * Update nightly in CI
1 year ago
[[audits.mozilla.audits.proc-macro2]]
who = "Jan-Erik Rediger <jrediger@mozilla.com>"
criteria = "safe-to-deploy"
delta = "1.0.57 -> 1.0.59"
notes = "Enabled on Wasm"
aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
Update a few dependencies to pull in `cargo vet` entries (#6247) This trims down the `[exemptions]` list ever-so-slightly by following the suggestions of `cargo vet suggest` and updating a few crates across some minor versions.
2 years ago
[[audits.mozilla.audits.rayon]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "1.5.3"
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.rayon-core]]
who = "Josh Stone <jistone@redhat.com>"
criteria = "safe-to-deploy"
version = "1.9.3"
notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Bump regalloc2 to 0.7.0 (#6237) * Bump RA2 to 0.7.0 * Certify the RA2 update * Import the rustc-hash audit * Updates for regalloc2 prtest:full * Update tests
2 years ago
[[audits.mozilla.audits.rustc-hash]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
version = "1.1.0"
notes = "Straightforward crate with no unsafe code, does what it says on the tin."
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update a few dependencies to pull in `cargo vet` entries (#6247) This trims down the `[exemptions]` list ever-so-slightly by following the suggestions of `cargo vet suggest` and updating a few crates across some minor versions.
2 years ago
[[audits.mozilla.audits.similar]]
who = "Nika Layzell <nika@thelayzells.com>"
criteria = "safe-to-deploy"
version = "2.2.0"
notes = """
Algorithm crate implemented entirely in safe rust. Does no platform-specific
logic, only implementing diffing and string manipulation algorithms.
"""
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
wasi-http supply chain audit (#6121) * add cargo-deny exception for duplicate versions of windows-sys * cargo vetting for all new deps introduced by https://github.com/bytecodealliance/wasmtime/pull/5929 The audits are straightforward. The exemptions, as always, need to be justified: * core-foundation, core-foundation-sys, security-framework, security-framework-sys: these are large crates which are FFI bindings to Mac OS frameworks. As such they contain tons of unsafe code to make these FFI calls and manage memory. These crates are too big to audit. * schannel: same as the above, except this is a windows component, which I&#39;m also unfamiliar with. * openssl, openssl-sys: also large FFI bindings which are impractical to audit. * futures-macro, futures-task: while not as complex as futures-util, these are beyond my personal understanding of futures to vet practically. I&#39;ve asked Alex to look at auditing these, and he will after he returns from vacation next week. * futures-util: 25kloc of code, over 149 instances of the substring &#34;unsafe&#34; (case insensitive), this is impractical to audit in the extreme. * h2, http, httparse, hyper, mio, tokio: this so-called tokio/hyper family are very large and challenging to audit. Bobby Holley has indicated that he is working to get the AWS engineers who maintain these crates to publish their own audits, which we can then import. We expect to exempt these until those imports are available.
2 years ago
[[audits.mozilla.audits.slab]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.4.6 -> 0.4.7"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
[[audits.mozilla.audits.socket2]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.4.4 -> 0.4.7"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Trust crates published by dtolnay, epage, cuviper, Amanieu (#6697) We discussed this in today&#39;s Wasmtime meeting and the consensus was that we trust each of these people to have a sufficient standard of care for anything they release. This reduces our estimated audit backlog by about 184 kLOC. For the most part, the trust records I&#39;m adding here are identical to trust records that Mozilla is using. The fact that they&#39;ve also decided these publishers are trustworthy is reassuring additional evidence for our decision. The exceptions and notable cases are as follows: I&#39;ve chosen to not trust three crates by these authors that Mozilla did not trust. I suspect Mozilla simply doesn&#39;t use these crates or has manually audited them, rather than there being any problem with the crates themselves. But I&#39;ve chosen to be conservative about what we trust. - autocfg: we only have an exception for an old version, and that version is only used transitively by wasi-crypto. - env_logger: Mozilla has audited some versions; we should update, or add delta audits. - thread_local: only used by tracing-subscriber which is only used in dev-dependencies. I&#39;ve trusted one crate that Mozilla did not: libm, when published by Amanieu. We&#39;re trusting libc when published by the same author, and libm is a small extension of the same trust. Recent versions of the toml crate have been published by epage so I looked at in this process, but Mozilla only trusts the older versions which were published by alexcrichton. They&#39;ve been delta-auditing the newer versions. I&#39;ve chosen to follow their lead on this; Alex is a trusted contributor to Wasmtime anyway.
1 year ago
[[audits.mozilla.audits.toml]]
who = "Bobby Holley <bobbyholley@gmail.com>"
criteria = "safe-to-deploy"
delta = "0.5.7 -> 0.5.9"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update the wasm-tools family of crates (#5310) Most of the changes here are the updates to the component model which includes optional URL fields in imports/exports.
2 years ago
[[audits.mozilla.audits.unicode-normalization]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.19 -> 0.1.20"
notes = "I am the author of most of these changes upstream, and prepared the release myself, at which point I looked at the other changes since 0.1.19."
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
Update the wasm-tools family of crates (#5310) Most of the changes here are the updates to the component model which includes optional URL fields in imports/exports.
2 years ago
[[audits.mozilla.audits.unicode-normalization]]
who = "Mike Hommey <mh+mozilla@glandium.org>"
criteria = "safe-to-deploy"
delta = "0.1.20 -> 0.1.21"
Update cargo-vet imports (#5959) * Switch cargo-vet import to Mozilla&#39;s aggregated audit set. * Import audits from embark studios. * Import audits from chromeos. * Import audits from ISRG.
2 years ago
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"