From 9ff0eddaf6af7e580b0e4e3d154eeea16e2e539b Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Fri, 28 Aug 2026 09:42:35 -0700 Subject: [PATCH 1/3] Bump cargo-vet to 0.10.2 --- .github/workflows/cargo-vet.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cargo-vet.yml b/.github/workflows/cargo-vet.yml index 0f61b17..a679fce 100644 --- a/.github/workflows/cargo-vet.yml +++ b/.github/workflows/cargo-vet.yml @@ -16,7 +16,7 @@ jobs: name: vet-dependencies runs-on: ubuntu-latest env: - CARGO_VET_VERSION: 0.10.1 + CARGO_VET_VERSION: 0.10.2 steps: - uses: actions/checkout@v4 From 8f6bc7898f59e283402a035c446d5413c7d9b6a7 Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Fri, 28 Aug 2026 09:56:46 -0700 Subject: [PATCH 2/3] Reformat supply-chain store for cargo-vet 0.10.2 --- supply-chain/imports.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index d29d8ea..b9400ec 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -304,8 +304,8 @@ who = "Lukasz Anforowicz " criteria = "safe-to-deploy" version = "1.0.78" notes = """ -Grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits -(except for a benign \"fs\" hit in a doc comment) +Grepped for "crypt", "cipher", "fs", "net" - there were no hits +(except for a benign "fs" hit in a doc comment) Notes from the `unsafe` review can be found in https://crrev.com/c/5385745. """ @@ -423,8 +423,8 @@ who = "Lukasz Anforowicz " criteria = "safe-to-deploy" version = "1.0.35" notes = """ -Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits -(except for benign \"net\" hit in tests and \"fs\" hit in README.md) +Grepped for "unsafe", "crypt", "cipher", "fs", "net" - there were no hits +(except for benign "net" hit in tests and "fs" hit in README.md) """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" @@ -529,7 +529,7 @@ and there were no hits except for: * Using `unsafe` in a string: ``` - src/constfn.rs: \"unsafe\" => Qualifiers::Unsafe, + src/constfn.rs: "unsafe" => Qualifiers::Unsafe, ``` * Using `std::fs` in `build/build.rs` to write `${OUT_DIR}/version.expr` From 4f97efcdb63de7a0e09b11166c6891a31fe019db Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Fri, 28 Aug 2026 10:16:00 -0700 Subject: [PATCH 3/3] Ignore RUSTSEC-2026-0173: proc-macro-error2 is unmaintained --- deny.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/deny.toml b/deny.toml index 9ddd12f..23d83e6 100644 --- a/deny.toml +++ b/deny.toml @@ -76,6 +76,7 @@ ignore = [ #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" }, { id = "RUSTSEC-2024-0370", reason = "proc-macro-error is unmaintained, no safe upgrade available, need upstream dependencies to migrate away from it." }, { id = "RUSTSEC-2024-0436", reason = "there are no suitable replacements for paste right now; paste has been archived as read-only. It only affects compile time concatenation in macros. We will allow it for now" }, + { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 is unmaintained, no safe upgrade available, need upstream dependencies to migrate away from it. Supersedes RUSTSEC-2024-0370 for the proc-macro-error2 fork." }, ] # If this is true, then cargo deny will use the git executable to fetch advisory database. # If this is false, then it uses a built-in git library.