From b574e2f37d4796cfa9b00890336da374ca235cf4 Mon Sep 17 00:00:00 2001 From: Jeffrey Charles Date: Fri, 27 Oct 2023 08:01:26 -0700 Subject: [PATCH] Update Rustix to address security notification (#546) --- Cargo.lock | 35 ++++++++++++++++++++------------- supply-chain/config.toml | 10 +++++----- supply-chain/imports.lock | 41 ++++++++++++++------------------------- 3 files changed, 42 insertions(+), 44 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 49b8b200..6d501ddf 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -227,7 +227,7 @@ version = "0.68.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "726e4313eb6ec35d2730258ad4e15b547ee75d6afaa1361a922e78e59b7d8078" dependencies = [ - "bitflags 2.3.3", + "bitflags 2.4.1", "cexpr", "clang-sys", "lazy_static", @@ -252,9 +252,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" [[package]] name = "bitflags" -version = "2.3.3" +version = "2.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42" +checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07" [[package]] name = "block-buffer" @@ -1055,7 +1055,7 @@ version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd" dependencies = [ - "bitflags 2.3.3", + "bitflags 2.4.1", "debugid", "fxhash", "serde", @@ -2140,6 +2140,15 @@ dependencies = [ "bitflags 1.3.2", ] +[[package]] +name = "redox_syscall" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa" +dependencies = [ + "bitflags 1.3.2", +] + [[package]] name = "redox_users" version = "0.4.0" @@ -2257,11 +2266,11 @@ dependencies = [ [[package]] name = "rustix" -version = "0.38.8" +version = "0.38.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "19ed4fa021d81c8392ce04db050a3da9a60299050b7ae1cf482d862b54a7218f" +checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3" dependencies = [ - "bitflags 2.3.3", + "bitflags 2.4.1", "errno 0.3.1", "libc", "linux-raw-sys 0.4.10", @@ -2638,7 +2647,7 @@ version = "0.110.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2505e1bb74456695f6a92e68005a5fd1054fb3516e88268e81dbcfa4b26394b4" dependencies = [ - "bitflags 2.3.3", + "bitflags 2.4.1", "is-macro", "num-bigint", "scoped-tls", @@ -2675,7 +2684,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "18150ea5c817b8f2f13c06fd99229d82754efc5c32e07dbf9745a33dc8d8232e" dependencies = [ "better_scoped_tls", - "bitflags 2.3.3", + "bitflags 2.4.1", "indexmap 1.9.3", "once_cell", "phf", @@ -2817,14 +2826,14 @@ checksum = "d7fa7e55043acb85fca6b3c01485a2eeb6b69c5d21002e273c79e465f43b7ac1" [[package]] name = "tempfile" -version = "3.8.0" +version = "3.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef" +checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5" dependencies = [ "cfg-if", "fastrand", - "redox_syscall 0.3.5", - "rustix 0.38.8", + "redox_syscall 0.4.1", + "rustix 0.38.21", "windows-sys 0.48.0", ] diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 9be1bbd3..03f594a8 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -297,10 +297,6 @@ criteria = "safe-to-deploy" version = "2.0.2" criteria = "safe-to-deploy" -[[exemptions.instant]] -version = "0.1.12" -criteria = "safe-to-deploy" - [[exemptions.ipnet]] version = "2.3.1" criteria = "safe-to-deploy" @@ -457,6 +453,10 @@ criteria = "safe-to-deploy" version = "0.3.5" criteria = "safe-to-deploy" +[[exemptions.redox_syscall]] +version = "0.4.1" +criteria = "safe-to-deploy" + [[exemptions.redox_users]] version = "0.4.0" criteria = "safe-to-deploy" @@ -618,7 +618,7 @@ version = "0.5.8" criteria = "safe-to-deploy" [[exemptions.tempfile]] -version = "3.4.0" +version = "3.8.1" criteria = "safe-to-deploy" [[exemptions.textwrap]] diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 532a7dcd..48b28d02 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -391,8 +391,8 @@ user-login = "sunfishcode" user-name = "Dan Gohman" [[publisher.rustix]] -version = "0.38.8" -when = "2023-08-10" +version = "0.38.21" +when = "2023-10-26" user-id = 6825 user-login = "sunfishcode" user-name = "Dan Gohman" @@ -1340,12 +1340,6 @@ who = "Pat Hickey " criteria = "safe-to-deploy" version = "1.0.0-rc.2" -[[audits.bytecode-alliance.audits.http-body-util]] -who = "Pat Hickey " -criteria = "safe-to-deploy" -version = "0.1.0-rc.2" -notes = "only one use of unsafe related to pin projection. unclear to me why pin_project! is used in many modules of the project, but the expanded output of that macro is inlined in either.rs" - [[audits.bytecode-alliance.audits.httpdate]] who = "Pat Hickey " criteria = "safe-to-deploy" @@ -1542,12 +1536,6 @@ criteria = "safe-to-deploy" delta = "0.25.6 -> 0.25.7" notes = "This is a minor bug-fix update." -[[audits.bytecode-alliance.audits.tempfile]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -delta = "3.5.0 -> 3.6.0" -notes = "Dependency updates and new optimized trait implementations, but otherwise everything looks normal." - [[audits.bytecode-alliance.audits.tinyvec]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -1901,6 +1889,19 @@ criteria = "safe-to-deploy" delta = "2.2.1 -> 2.3.2" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.bitflags]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "2.3.3 -> 2.4.0" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.bitflags]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "2.4.0 -> 2.4.1" +notes = "Only allowing new clippy lints" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + [[audits.mozilla.audits.crypto-common]] who = "Mike Hommey " criteria = "safe-to-deploy" @@ -2140,18 +2141,6 @@ criteria = "safe-to-deploy" delta = "0.10.2 -> 0.10.6" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.tempfile]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "3.4.0 -> 3.5.0" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.tempfile]] -who = "Mike Hommey " -criteria = "safe-to-deploy" -delta = "3.6.0 -> 3.8.0" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.unicode-bidi]] who = "Makoto Kato " criteria = "safe-to-deploy"