diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b50cfb09c..b210430e8 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -107,6 +107,30 @@ updates: # rationale sits next to the dep in the root Cargo.toml. - dependency-name: "branches" + # oxc_* is held at 0.117.x, and not for API churn alone. bashkit declares + # these five (`oxc_parser`, `oxc_ast`, `oxc_allocator`, `oxc_span`, + # `oxc_syntax`) for the wasm32-unknown-unknown TypeScript path, where + # `zapcode_browser/parser` walks the oxc AST directly. The versions exist + # to match what upstream `zapcode-core` vendors — see the pin comment next + # to the deps in crates/bashkit/Cargo.toml. + # + # `zapcode-core` 1.5.1 requires `oxc ^0.117`, so it does not move with a + # bump of bashkit's declaration. #2758 bumped to 0.154.0 and resolved a + # *second* copy of all 13 oxc crates, leaving the two sides of the same + # parser pipeline on trees 37 minor versions apart — and 0.154 also needs + # rustc 1.97.0 against the 1.95.0 in rust-toolchain.toml, which is what + # reddened the "WASM web package" job, the same shape as the wasmtime + # 49.x failure in #2708. It also pulled in 19 unvetted crates + # (`compact_str` 0.10, `phf` 0.14, `oxc_index` 5.0 and the oxc stack). + # + # Ignore outright rather than by update-type: every release past 0.117.x + # splits the graph the same way, so no bump helps until `zapcode-core` + # moves upstream. Doing it then means bumping the pinned toolchain and + # porting the vendored parser together — a deliberate change, not an + # aggregated `chore(deps)` PR. Without this entry dependabot reopens the + # same unlandable PR every week. + - dependency-name: "oxc_*" + # Fuzz targets are a separate cargo workspace with their own lockfile, so the # "/" entry above never touches them. Without this the fuzz lockfile silently # rots between releases (it drifted onto an unsound `anyhow` and two yanked diff --git a/Cargo.lock b/Cargo.lock index d41ed3467..0c957da92 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -253,7 +253,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -418,7 +418,7 @@ dependencies = [ "serde_norway", "serial_test", "sha1", - "sha2 0.11.0", + "sha2 0.11.1", "tempfile", "thiserror", "tokio", @@ -484,7 +484,7 @@ dependencies = [ "proc-macro2", "quote", "serde", - "syn 3.0.8", + "syn 3.0.9", "tempfile", "toml", ] @@ -585,7 +585,7 @@ checksum = "144e573728da132683b9488acd528274c790e07fc06ff81ee29f9d8f8b1041e0" dependencies = [ "blowfish", "pbkdf2", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -727,7 +727,7 @@ dependencies = [ "proc-macro-crate", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -782,7 +782,7 @@ checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -975,7 +975,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -1029,7 +1029,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1640,7 +1640,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -1696,7 +1696,7 @@ dependencies = [ "ed25519", "rand_core 0.10.1", "serde", - "sha2 0.11.0", + "sha2 0.11.1", "signature", "subtle", "zeroize", @@ -1779,7 +1779,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1966,7 +1966,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -2983,7 +2983,7 @@ checksum = "77060ebe535362c3da75682cd17b0431017b6e7c5661e714fc69a7ad017d1301" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -3303,7 +3303,7 @@ dependencies = [ "napi-derive-backend", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -3316,7 +3316,7 @@ dependencies = [ "proc-macro2", "quote", "semver", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -3687,7 +3687,7 @@ dependencies = [ "elliptic-curve", "primefield", "primeorder", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -3701,7 +3701,7 @@ dependencies = [ "fiat-crypto", "primefield", "primeorder", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -3715,7 +3715,7 @@ dependencies = [ "elliptic-curve", "primefield", "primeorder", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -3750,7 +3750,7 @@ dependencies = [ "futures", "log", "rand 0.10.3", - "sha2 0.11.0", + "sha2 0.11.1", "thiserror", "tokio", "windows", @@ -3969,7 +3969,7 @@ dependencies = [ "pbkdf2", "rand_core 0.10.1", "scrypt", - "sha2 0.11.0", + "sha2 0.11.1", "spki", ] @@ -4133,7 +4133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -4641,7 +4641,7 @@ dependencies = [ "pkcs1", "pkcs8", "rand_core 0.10.1", - "sha2 0.11.0", + "sha2 0.11.1", "signature", "spki", "zeroize", @@ -4788,7 +4788,7 @@ dependencies = [ "scrypt", "sec1", "sha1", - "sha2 0.11.0", + "sha2 0.11.1", "sha3 0.12.0", "signature", "spki", @@ -4867,7 +4867,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4925,7 +4925,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5040,7 +5040,7 @@ dependencies = [ "cfg-if", "pbkdf2", "salsa20", - "sha2 0.11.0", + "sha2 0.11.1", ] [[package]] @@ -5149,7 +5149,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -5219,7 +5219,7 @@ checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -5252,9 +5252,9 @@ dependencies = [ [[package]] name = "sha2" -version = "0.11.0" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" +checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19" dependencies = [ "cfg-if", "cpufeatures 0.3.1", @@ -5515,7 +5515,7 @@ dependencies = [ "rsa", "sec1", "sha1", - "sha2 0.11.0", + "sha2 0.11.1", "signature", "ssh-cipher", "ssh-encoding", @@ -5596,9 +5596,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.8" +version = "3.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "01016da373cd8f7ef12624f796309f5c31ba8d646dd08856c02cd741d823c622" +checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b" dependencies = [ "proc-macro2", "quote", @@ -5667,10 +5667,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5735,7 +5735,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -5785,9 +5785,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.2" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "libc", @@ -5807,7 +5807,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] @@ -6446,7 +6446,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", "wasm-bindgen-shared", ] @@ -6769,7 +6769,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7181,7 +7181,7 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.8", + "syn 3.0.9", ] [[package]] diff --git a/knowledge/operations/dependencies.md b/knowledge/operations/dependencies.md index fbbba52c8..cfc18a3b6 100644 --- a/knowledge/operations/dependencies.md +++ b/knowledge/operations/dependencies.md @@ -133,6 +133,31 @@ no runtime surface by itself. Remove it when `branches` compiles on nightly without `std`. +## oxc is held at 0.117.x by the vendored ZapCode parser + +`bashkit` declares five oxc crates (`oxc_parser`, `oxc_ast`, `oxc_allocator`, +`oxc_span`, `oxc_syntax`) for the `wasm32-unknown-unknown` TypeScript path, +where `zapcode_browser/parser` walks the oxc AST directly rather than going +through the published `zapcode-core`. The versions are chosen to match what +upstream ZapCode vendors, so the two sides of the same parser pipeline agree. + +`zapcode-core` 1.5.1 requires `oxc ^0.117`, so it does not move when bashkit's +declaration does. #2758 bumped the declaration to 0.154.0 and Cargo resolved a +**second** copy of all 13 oxc crates — `oxc_parser`, `oxc_ast` and the rest +each appearing at both 0.117.0 and 0.154.0 — putting the vendored parser and +`zapcode-core` 37 minor versions apart. Two further costs came with it: oxc +0.154 requires rustc 1.97.0 against the 1.95.0 in `rust-toolchain.toml` (the +`WASM web package` job failed at resolution, the same shape as the wasmtime +49.x failure in #2708), and it added 19 unvetted crates, including +`compact_str` 0.10, `phf` 0.14 and `oxc_index` 5.0. + +`oxc_*` is therefore in dependabot's `ignore` list outright, not by +update-type: every release past 0.117.x splits the graph the same way, so there +is no version to bump to. Lifting it waits on a `zapcode-core` release built +against a newer oxc, and then means bumping the pinned toolchain and porting +the vendored parser in one deliberate change — not inside an aggregated +`chore(deps)` PR. + ## Measure size and audit surface separately The `idna_adapter` pin removes 21 crates but only **15 KB (0.16%)** from the diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 99ee679bf..f71744dd7 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -178,14 +178,6 @@ criteria = "safe-to-deploy" version = "0.4.10" criteria = "safe-to-deploy" -[[exemptions.bit-set]] -version = "0.11.1" -criteria = "safe-to-run" - -[[exemptions.bit-vec]] -version = "0.10.1" -criteria = "safe-to-run" - [[exemptions.bitflags]] version = "1.3.2" criteria = "safe-to-deploy" @@ -384,10 +376,6 @@ criteria = "safe-to-deploy" version = "0.10.1" criteria = "safe-to-deploy" -[[exemptions.core_detect]] -version = "1.0.0" -criteria = "safe-to-run" - [[exemptions.cow-utils]] version = "0.1.3" criteria = "safe-to-deploy" @@ -652,10 +640,6 @@ criteria = "safe-to-deploy" version = "0.3.34" criteria = "safe-to-deploy" -[[exemptions.futures-core]] -version = "0.3.34" -criteria = "safe-to-deploy" - [[exemptions.futures-executor]] version = "0.3.34" criteria = "safe-to-deploy" @@ -1301,10 +1285,6 @@ criteria = "safe-to-deploy" version = "0.6.1" criteria = "safe-to-deploy" -[[exemptions.pastey]] -version = "0.2.3" -criteria = "safe-to-deploy" - [[exemptions.pbkdf2]] version = "0.13.0" criteria = "safe-to-deploy" @@ -1375,10 +1355,6 @@ criteria = "safe-to-deploy" version = "0.11.0" criteria = "safe-to-deploy" -[[exemptions.pkg-config]] -version = "0.3.34" -criteria = "safe-to-deploy" - [[exemptions.plotters]] version = "0.3.7" criteria = "safe-to-run" @@ -1789,7 +1765,7 @@ version = "0.10.9" criteria = "safe-to-deploy" [[exemptions.sha2]] -version = "0.11.0" +version = "0.11.1" criteria = "safe-to-deploy" [[exemptions.sha3]] @@ -1913,7 +1889,7 @@ version = "2.0.119" criteria = "safe-to-deploy" [[exemptions.syn]] -version = "3.0.4" +version = "3.0.9" criteria = "safe-to-deploy" [[exemptions.sync_wrapper]] @@ -2028,10 +2004,6 @@ criteria = "safe-to-deploy" version = "0.1.31" criteria = "safe-to-deploy" -[[exemptions.tracing-core]] -version = "0.1.36" -criteria = "safe-to-deploy" - [[exemptions.tracing-subscriber]] version = "0.3.23" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 687226848..1d6db1da2 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -112,8 +112,8 @@ user-login = "epage" user-name = "Ed Page" [[publisher.tokio]] -version = "1.53.1" -when = "2026-07-20" +version = "1.53.3" +when = "2026-10-13" user-id = 6741 user-login = "Darksonn" user-name = "Alice Ryhl" @@ -683,6 +683,17 @@ this crate has to do with iterators and `Result` and such. No `unsafe` or anything like that, all looks good. """ +[[audits.bytecodealliance.audits.futures-core]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +version = "0.3.27" +notes = "Unsafe used to implement a concurrency primitive AtomicWaker. Well-commented and not obviously incorrect. Like my other audits of these concurrency primitives inside the futures family, I couldn't certify that it is correct without formal methods, but that is out of scope for this vetting." + +[[audits.bytecodealliance.audits.futures-core]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +delta = "0.3.28 -> 0.3.31" + [[audits.bytecodealliance.audits.heck]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -741,6 +752,12 @@ criteria = "safe-to-deploy" version = "0.2.19" notes = "As advertised: a numeric library. The only `unsafe` is from some float-to-int conversions, which seems expected." +[[audits.bytecodealliance.audits.pastey]] +who = "Chris Fallin " +criteria = "safe-to-deploy" +version = "0.2.1" +notes = "No unsafe code." + [[audits.bytecodealliance.audits.percent-encoding]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -751,6 +768,26 @@ a few `unsafe` blocks related to utf-8 validation which are locally verifiable as correct and otherwise this crate is good to go. """ +[[audits.bytecodealliance.audits.pkg-config]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +version = "0.3.25" +notes = "This crate shells out to the pkg-config executable, but it appears to sanitize inputs reasonably." + +[[audits.bytecodealliance.audits.pkg-config]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.3.26 -> 0.3.29" +notes = """ +No `unsafe` additions or anything outside of the purview of the crate in this +change. +""" + +[[audits.bytecodealliance.audits.pkg-config]] +who = "Chris Fallin " +criteria = "safe-to-deploy" +delta = "0.3.29 -> 0.3.32" + [[audits.bytecodealliance.audits.postcard]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -811,6 +848,12 @@ intended to multiplex across the internal representation of a tinyvec, presumably. This trivially doesn't contain anything bad. """ +[[audits.bytecodealliance.audits.tracing-core]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.1.33 -> 0.1.34" +notes = "Mostly just an update with Rust stylistic conventions changing. Nothing awry." + [[audits.bytecodealliance.audits.tracing-log]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -1028,6 +1071,18 @@ criteria = "safe-to-deploy" delta = "1.2.1 -> 1.2.2" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.futures-core]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.27 -> 0.3.28" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.futures-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.3.31 -> 0.3.34" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" + [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -1084,6 +1139,12 @@ version = "11.1.5" notes = "Small random number generator, explicitly not cryptographically secure, no use of unsafe code, no dependencies" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" +[[audits.mozilla.audits.pastey]] +who = "Lars Eggert " +criteria = "safe-to-deploy" +delta = "0.2.1 -> 0.2.3" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.percent-encoding]] who = "Valentin Gosu " criteria = "safe-to-deploy" @@ -1102,6 +1163,18 @@ criteria = "safe-to-deploy" delta = "2.3.1 -> 2.3.2" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.pkg-config]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.3.25 -> 0.3.26" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.pkg-config]] +who = "Max Inden " +criteria = "safe-to-deploy" +delta = "0.3.32 -> 0.3.34" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + [[audits.mozilla.audits.rustc_version]] who = "Nika Layzell " criteria = "safe-to-deploy" @@ -1218,6 +1291,29 @@ criteria = "safe-to-deploy" delta = "0.1.0 -> 0.1.1" aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" +[[audits.mozilla.audits.tracing-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +version = "0.1.30" +notes = """ +Most unsafe code is in implementing non-std sync primitives. Unsafe impls are +logically correct and justified in comments, and unsafe code is sound and +justified in comments. +""" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Mark Hammond " +criteria = "safe-to-deploy" +delta = "0.1.30 -> 0.1.33" +aggregated-from = "https://raw.githubusercontent.com/mozilla-firefox/firefox/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.tracing-core]] +who = "Alex Franchuk " +criteria = "safe-to-deploy" +delta = "0.1.34 -> 0.1.36" +aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml" + [[audits.mozilla.audits.unicode-linebreak]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy"