diff --git a/CHANGELOG.md b/CHANGELOG.md index 273bbe0a..9b0d2ad7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,4 @@ ### 1.6.0 ### -* :shield: rodbus is not affected by [GHSA-qwgh-2vcv-g2f7](https://github.com/advisories/GHSA-qwgh-2vcv-g2f7), which scanners report against `block-buffer` 0.10.4. The inline cursor the advisory describes doesn't exist in 0.10, and rodbus reaches `block-buffer` only when TLS decrypts a password-protected private key file. OSV-Scanner now ignores it with this reasoning. See [#354](https://github.com/stepfunc/rodbus/pull/354). ### 1.6.0-M3 ### * :bell: **License update.** The license now prohibits using the library, including its source, documentation, tests and binaries, to design, develop, specify, test or improve any other implementation of the protocol, whether commercial or open source, and reserves text and data mining, including AI training. AI-assisted evaluation and integration remain welcome. Coding agents get the policy from the new `AGENTS.md`. See [#224](https://github.com/stepfunc/rodbus/pull/224). diff --git a/CLAUDE.md b/CLAUDE.md index 734eaa3f..4ca97891 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -30,7 +30,8 @@ written license terms and authorizations govern. - The `audit` (cargo-audit) and `osv-scanner` CI jobs fail when an advisory is published against a locked dependency, including on unrelated PRs. Check whether `main` is affected, then fix it in its own PR against `main` (usually `cargo update -p `) and rebase open PRs once it merges - The PR description must say whether rodbus, as configured, is exposed and why, citing the code that decides it. This analysis is what determines whether released versions need a patch or an announcement - To assess exposure, check what the released lockfiles (`git show :Cargo.lock`) pinned and how rodbus uses the affected code. For TLS: `sfio-rustls-config` builds the trust store from `RootCertStore::empty()` plus only the configured CA file (no system or `webpki-roots` certificates), `CertificateMode::AuthorityBased` uses the webpki verifiers against that store, and `CertificateMode::SelfSigned` rejects any intermediates and compares the peer certificate byte for byte without building a chain -- Add a `:shield:` changelog entry naming the advisory and the exposure. Rust users pick up a fixed dependency on their next `cargo update`, so a lockfile update only changes the prebuilt bindings (C/C++, .NET, Java); say so +- Add a `:shield:` changelog entry only when the advisory matters to users: Rust users in a realistic configuration, or users of the prebuilt bindings (C/C++, .NET, Java), which ship the locked version. Name the advisory and the exposure. Rust users pick up a fixed dependency on their next `cargo update`, so a lockfile update only changes the prebuilt bindings; say so. An advisory that affects no user gets no entry; the PR description records why +- A lockfile update that adds crates to the bindings needs their licenses in `allowed.json`, which `bom-tools` checks only in the packaging job (tags, or `gh workflow run ci.yml --ref `) - If released versions are exposed in a realistic configuration, raise a patch release with the maintainer; otherwise the fix ships in the next release ## Code Style Guidelines diff --git a/Cargo.lock b/Cargo.lock index 3b4bbeb3..ea3ad0db 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -17,15 +17,39 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" +[[package]] +name = "aead" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99" +dependencies = [ + "crypto-common", + "inout", +] + [[package]] name = "aes" -version = "0.8.4" +version = "0.9.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" +checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32" dependencies = [ - "cfg-if", "cipher", - "cpufeatures 0.2.17", + "cpubits", + "cpufeatures", +] + +[[package]] +name = "aes-gcm" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f" +dependencies = [ + "aead", + "aes", + "cipher", + "ctr", + "ctutils", + "ghash", ] [[package]] @@ -166,20 +190,20 @@ checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" [[package]] name = "block-buffer" -version = "0.10.4" +version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" +checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" dependencies = [ - "generic-array", + "hybrid-array", ] [[package]] name = "block-padding" -version = "0.3.3" +version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93" +checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b" dependencies = [ - "generic-array", + "hybrid-array", ] [[package]] @@ -196,9 +220,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04" [[package]] name = "cbc" -version = "0.1.2" +version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6" +checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896" dependencies = [ "cipher", ] @@ -240,8 +264,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", - "cpufeatures 0.3.1", - "rand_core 0.10.1", + "cpufeatures", + "rand_core", ] [[package]] @@ -257,10 +281,11 @@ dependencies = [ [[package]] name = "cipher" -version = "0.4.4" +version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" +checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c" dependencies = [ + "block-buffer", "crypto-common", "inout", ] @@ -314,6 +339,12 @@ dependencies = [ "cc", ] +[[package]] +name = "cmov" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" + [[package]] name = "colorchoice" version = "1.0.5" @@ -332,9 +363,9 @@ dependencies = [ [[package]] name = "const-oid" -version = "0.9.6" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" [[package]] name = "core-foundation" @@ -359,13 +390,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48" [[package]] -name = "cpufeatures" -version = "0.2.17" +name = "cpubits" +version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] +checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae" [[package]] name = "cpufeatures" @@ -393,19 +421,36 @@ checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853" [[package]] name = "crypto-common" -version = "0.1.7" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" +checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ - "generic-array", - "typenum", + "hybrid-array", +] + +[[package]] +name = "ctr" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21" +dependencies = [ + "cipher", +] + +[[package]] +name = "ctutils" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fe3e9d21d39e6f39ff46e03d5b621424f88ee23d8a1672c6bfc9ccc7f2da4f6a" +dependencies = [ + "cmov", ] [[package]] name = "der" -version = "0.7.10" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" +checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004" dependencies = [ "const-oid", "pem-rfc7468", @@ -414,13 +459,13 @@ dependencies = [ [[package]] name = "digest" -version = "0.10.7" +version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ "block-buffer", "crypto-common", - "subtle", + "ctutils", ] [[package]] @@ -506,16 +551,6 @@ dependencies = [ "slab", ] -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - [[package]] name = "getrandom" version = "0.2.17" @@ -536,7 +571,16 @@ dependencies = [ "cfg-if", "libc", "r-efi", - "rand_core 0.10.1", + "rand_core", +] + +[[package]] +name = "ghash" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5" +dependencies = [ + "polyval", ] [[package]] @@ -559,13 +603,22 @@ checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284" [[package]] name = "hmac" -version = "0.12.1" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" +checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" dependencies = [ "digest", ] +[[package]] +name = "hybrid-array" +version = "0.4.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17" +dependencies = [ + "typenum", +] + [[package]] name = "iana-time-zone" version = "0.1.65" @@ -592,12 +645,12 @@ dependencies = [ [[package]] name = "inout" -version = "0.1.4" +version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01" +checksum = "3b5cf4372d022092674a83b8febf5865f7a573cc0c5baec5e49c879b6a20978f" dependencies = [ "block-padding", - "generic-array", + "hybrid-array", ] [[package]] @@ -865,9 +918,9 @@ dependencies = [ [[package]] name = "pbkdf2" -version = "0.12.2" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" +checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629" dependencies = [ "digest", "hmac", @@ -885,9 +938,9 @@ dependencies = [ [[package]] name = "pem-rfc7468" -version = "0.7.0" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412" +checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9" dependencies = [ "base64ct", ] @@ -900,14 +953,16 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" [[package]] name = "pkcs5" -version = "0.7.1" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6" +checksum = "63d440a804ec8d6fafbb6b84471e013286658d373248927692ab3366686220ca" dependencies = [ "aes", + "aes-gcm", "cbc", "der", "pbkdf2", + "rand_core", "scrypt", "sha2", "spki", @@ -915,13 +970,13 @@ dependencies = [ [[package]] name = "pkcs8" -version = "0.10.2" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" +checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7" dependencies = [ "der", "pkcs5", - "rand_core 0.6.4", + "rand_core", "spki", ] @@ -937,6 +992,17 @@ version = "2.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e8d0eef3571242013a0d5dc84861c3ae4a652e56e12adf8bdc26ff5f8cb34c94" +[[package]] +name = "polyval" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd" +dependencies = [ + "cpubits", + "cpufeatures", + "universal-hash", +] + [[package]] name = "proc-macro2" version = "1.0.107" @@ -984,15 +1050,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af" dependencies = [ "getrandom 0.4.3", - "rand_core 0.10.1", + "rand_core", ] -[[package]] -name = "rand_core" -version = "0.6.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" - [[package]] name = "rand_core" version = "0.10.1" @@ -1005,7 +1065,7 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf" dependencies = [ - "rand_core 0.10.1", + "rand_core", ] [[package]] @@ -1194,10 +1254,11 @@ checksum = "d3b4a7d26e4a603b3cedff6a968d356e445c10dbc3e4cf6bd414fd5428437e73" [[package]] name = "salsa20" -version = "0.10.2" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213" +checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c" dependencies = [ + "cfg-if", "cipher", ] @@ -1218,10 +1279,11 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" [[package]] name = "scrypt" -version = "0.11.0" +version = "0.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f" +checksum = "d87af57419b594aa23fa95f09f0e06d80d84ba01c26148c43844cad6ff4485f0" dependencies = [ + "cfg-if", "pbkdf2", "salsa20", "sha2", @@ -1308,9 +1370,9 @@ checksum = "91547be5cac1551a6401a7cfa571524bbcb4d9d818b2756cbe3012b48cc79aaf" [[package]] name = "sfio-rustls-config" -version = "0.4.0" +version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9897a16c2c2da20771fc042228f1484b8166889df83a675704f2926c8fe21778" +checksum = "ff0277b1d34b1e9128629f6ccc2ce642ee6b1883f4207dde4dcb9effea12d927" dependencies = [ "pem", "pkcs8", @@ -1349,12 +1411,12 @@ dependencies = [ [[package]] name = "sha2" -version = "0.10.9" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" +checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19" dependencies = [ "cfg-if", - "cpufeatures 0.2.17", + "cpufeatures", "digest", ] @@ -1397,9 +1459,9 @@ dependencies = [ [[package]] name = "spki" -version = "0.7.3" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" +checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9" dependencies = [ "base64ct", "der", @@ -1673,6 +1735,16 @@ version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" +[[package]] +name = "universal-hash" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96" +dependencies = [ + "crypto-common", + "ctutils", +] + [[package]] name = "untrusted" version = "0.9.0" @@ -1691,12 +1763,6 @@ version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65" -[[package]] -name = "version_check" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" - [[package]] name = "walkdir" version = "2.5.0" @@ -1764,7 +1830,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/allowed.json b/allowed.json index 1f0ec6f3..8344b9e6 100644 --- a/allowed.json +++ b/allowed.json @@ -49,7 +49,6 @@ "ucd-trie", "utf8parse", "unicode-segmentation", - "version_check", "walkdir", "winapi-util", "cmake", @@ -71,6 +70,22 @@ } }, "third_party": { + "aead": { + "id": "aead", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2019-2026 The RustCrypto Project Developers", + "Copyright (c) 2019 MobileCoin, LLC" + ] + } + } + } + ] + }, "aes": { "id": "aes", "source": "crates.io", @@ -79,6 +94,7 @@ "MIT": { "copyright": { "Lines": [ + "Copyright (c) 2018-2024 The RustCrypto Project Developers", "Copyright (c) 2018 Artyom Pavlov" ] } @@ -86,6 +102,21 @@ } ] }, + "aes-gcm": { + "id": "aes-gcm", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2019-2026 The RustCrypto Project Developers" + ] + } + } + } + ] + }, "aho-corasick": { "id": "aho-corasick", "source": "crates.io", @@ -170,7 +201,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2018-2019 The RustCrypto Project Developers" + "Copyright (c) 2018-2025 The RustCrypto Project Developers" ] } } @@ -200,7 +231,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2018-2019 The RustCrypto Project Developers" + "Copyright (c) 2018-2025 The RustCrypto Project Developers" ] } } @@ -291,7 +322,22 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2016-2020 The RustCrypto Project Developers" + "Copyright (c) 2016-2025 RustCrypto Developers" + ] + } + } + } + ] + }, + "cmov": { + "id": "cmov", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2022-2026 The RustCrypto Project Developers" ] } } @@ -321,7 +367,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2020-2022 The RustCrypto Project Developers" + "Copyright (c) 2020-2026 The RustCrypto Project Developers" ] } } @@ -373,6 +419,21 @@ } ] }, + "cpubits": { + "id": "cpubits", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2023-2026 The RustCrypto Project Developers" + ] + } + } + } + ] + }, "cpufeatures": { "id": "cpufeatures", "source": "crates.io", @@ -381,7 +442,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2020 The RustCrypto Project Developers" + "Copyright (c) 2020-2026 The RustCrypto Project Developers" ] } } @@ -426,7 +487,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2021 RustCrypto Developers" + "Copyright (c) 2021-2026 RustCrypto Developers" ] } } @@ -448,6 +509,37 @@ } ] }, + "ctr": { + "id": "ctr", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2018-2022 RustCrypto Developers", + "Copyright (c) 2018 Artyom Pavlov" + ] + } + } + } + ] + }, + "ctutils": { + "id": "ctutils", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2025-2026 The RustCrypto Project Developers" + ] + } + } + } + ] + }, "der": { "id": "der", "source": "crates.io", @@ -456,7 +548,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2020-2022 The RustCrypto Project Developers" + "Copyright (c) 2020-2026 The RustCrypto Project Developers" ] } } @@ -471,6 +563,7 @@ "MIT": { "copyright": { "Lines": [ + "Copyright (c) 2017-2025 RustCrypto Developers", "Copyright (c) 2017 Artyom Pavlov" ] } @@ -622,8 +715,8 @@ } ] }, - "generic-array": { - "id": "generic-array", + "getrandom": { + "id": "getrandom", "source": "crates.io", "authors": null, "licenses": [ @@ -631,24 +724,23 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2015 Bartłomiej Kamiński" + "Copyright (c) 2018-2024 The rust-random Project Developers", + "Copyright (c) 2014 The Rust Project Developers" ] } } } ] }, - "getrandom": { - "id": "getrandom", + "ghash": { + "id": "ghash", "source": "crates.io", - "authors": null, "licenses": [ { "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2018-2024 The rust-random Project Developers", - "Copyright (c) 2014 The Rust Project Developers" + "Copyright (c) 2019-2026 The RustCrypto Project Developers" ] } } @@ -670,6 +762,21 @@ } ] }, + "hybrid-array": { + "id": "hybrid-array", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2022-2026 The RustCrypto Project Developers" + ] + } + } + } + ] + }, "io-kit-sys": { "id": "io-kit-sys", "source": "crates.io", @@ -723,7 +830,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2022 The RustCrypto Project Developers", + "Copyright (c) 2022-2025 The RustCrypto Project Developers", "Copyright (c) 2022 Artyom Pavlov" ] } @@ -1064,7 +1171,7 @@ "copyright": { "Lines": [ "Copyright (c) 2017 Artyom Pavlov", - "Copyright (c) 2018-2021 The RustCrypto Project Developers" + "Copyright (c) 2018-2023 The RustCrypto Project Developers" ] } } @@ -1094,7 +1201,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2021 The RustCrypto Project Developers" + "Copyright (c) 2021-2025 The RustCrypto Project Developers" ] } } @@ -1135,7 +1242,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2021 The RustCrypto Project Developers" + "Copyright (c) 2021-2026 The RustCrypto Project Developers" ] } } @@ -1150,7 +1257,22 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2020 The RustCrypto Project Developers" + "Copyright (c) 2020-2026 The RustCrypto Project Developers" + ] + } + } + } + ] + }, + "polyval": { + "id": "polyval", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2019-2026 The RustCrypto Project Developers" ] } } @@ -1195,8 +1317,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright 2018 Developers of the Rand project", - "Copyright (c) 2014 The Rust Project Developers" + "Copyright (c) 2018-2026 The Rand Project Developers" ] } } @@ -1324,6 +1445,7 @@ "MIT": { "copyright": { "Lines": [ + "Copyright (c) 2019-2026 The RustCrypto Project Developers", "Copyright (c) 2019 Eric McCorkle" ] } @@ -1354,7 +1476,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2021 The RustCrypto Project Developers" + "Copyright (c) 2021-2026 The RustCrypto Project Developers" ] } } @@ -1424,9 +1546,10 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2006-2009 Graydon Hoare", + "Copyright (c) 2016-2026 The RustCrypto Project Developers", + "Copyright (c) 2016 Artyom Pavlov", "Copyright (c) 2009-2013 Mozilla Foundation", - "Copyright (c) 2016 Artyom Pavlov" + "Copyright (c) 2006-2009 Graydon Hoare" ] } } @@ -1516,7 +1639,7 @@ "MIT": { "copyright": { "Lines": [ - "Copyright (c) 2021-2022 The RustCrypto Project Developers" + "Copyright (c) 2021-2026 The RustCrypto Project Developers" ] } } @@ -1808,6 +1931,21 @@ } ] }, + "universal-hash": { + "id": "universal-hash", + "source": "crates.io", + "licenses": [ + { + "MIT": { + "copyright": { + "Lines": [ + "Copyright (c) 2019-2025 RustCrypto Developers" + ] + } + } + } + ] + }, "untrusted": { "id": "untrusted", "source": "crates.io", diff --git a/osv-scanner.toml b/osv-scanner.toml deleted file mode 100644 index 432c4d25..00000000 --- a/osv-scanner.toml +++ /dev/null @@ -1,15 +0,0 @@ -# Advisories that OSV reports against Cargo.lock which we reviewed and found don't apply. Each -# entry says why, and expires so that it is reviewed again. - -# block-buffer 0.10.4 (through digest 0.10): the advisory lists every version below 0.12.1, but -# the mechanism it describes, a cursor stored inline in the block and overwritten before a -# callback that can panic, isn't in 0.10. There `BlockBuffer` keeps its cursor in a separate -# `pos` field that `digest_blocks` writes only after `compress` returns, and `ReadBuffer` doesn't -# exist. The fix (0.12.1) needs the digest 0.11 stack. rodbus reaches block-buffer only with the -# `tls` or `tls-aws-lc` feature, through sfio-rustls-config decrypting a password-protected -# private key file when a TLS configuration is built, with RustCrypto's compression functions as -# the callbacks. -[[IgnoredVulns]] -id = "GHSA-qwgh-2vcv-g2f7" -ignoreUntil = 2027-04-30 -reason = "block-buffer 0.10.4 doesn't contain the inline-cursor design the advisory describes; see osv-scanner.toml"