diff --git a/Cargo.lock b/Cargo.lock index 9b75ee30fd..5cfb6a64a1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -202,6 +202,15 @@ dependencies = [ "generic-array", ] +[[package]] +name = "block-buffer" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0bf7fe51849ea569fd452f37822f606a5cabb684dc918707a0193fd4664ff324" +dependencies = [ + "generic-array", +] + [[package]] name = "bstr" version = "0.2.17" @@ -537,7 +546,7 @@ dependencies = [ "miette", "regalloc2", "serde", - "sha2", + "sha2 0.10.2", "smallvec", "souper-ir", "target-lexicon", @@ -871,6 +880,16 @@ dependencies = [ "zeroize", ] +[[package]] +name = "crypto-common" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" +dependencies = [ + "generic-array", + "typenum", +] + [[package]] name = "crypto-mac" version = "0.11.1" @@ -925,7 +944,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0b9fdf9972b2bd6af2d913799d9ebc165ea4d2e65878e329d9c6b372c4491b61" dependencies = [ "byteorder", - "digest", + "digest 0.9.0", "rand_core 0.5.1", "subtle", "zeroize", @@ -972,6 +991,16 @@ dependencies = [ "generic-array", ] +[[package]] +name = "digest" +version = "0.10.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f2fb860ca6fafa5552fb6d0e816a69c8e49f0908bf524e30a90d97c85892d506" +dependencies = [ + "block-buffer 0.10.2", + "crypto-common", +] + [[package]] name = "directories-next" version = "2.0.0" @@ -1046,7 +1075,7 @@ dependencies = [ "ed25519", "rand 0.7.3", "serde", - "sha2", + "sha2 0.9.9", "zeroize", ] @@ -1374,7 +1403,7 @@ version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "01706d578d5c281058480e673ae4086a9f4710d8df1ad80a5b03e39ece5f886b" dependencies = [ - "digest", + "digest 0.9.0", "hmac", ] @@ -1385,7 +1414,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b" dependencies = [ "crypto-mac", - "digest", + "digest 0.9.0", ] [[package]] @@ -1573,7 +1602,7 @@ dependencies = [ "cfg-if", "ecdsa", "elliptic-curve", - "sha2", + "sha2 0.9.9", ] [[package]] @@ -1996,7 +2025,7 @@ checksum = "d053368e1bae4c8a672953397bd1bd7183dde1c72b0b7612a15719173148d186" dependencies = [ "ecdsa", "elliptic-curve", - "sha2", + "sha2 0.9.9", ] [[package]] @@ -2460,7 +2489,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e05c2603e2823634ab331437001b411b9ed11660fbc4066f3908c84a9439260d" dependencies = [ "byteorder", - "digest", + "digest 0.9.0", "lazy_static", "num-bigint-dig", "num-integer", @@ -2576,13 +2605,24 @@ version = "0.9.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800" dependencies = [ - "block-buffer", + "block-buffer 0.9.0", "cfg-if", "cpufeatures", - "digest", + "digest 0.9.0", "opaque-debug", ] +[[package]] +name = "sha2" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "55deaec60f81eefe3cce0dc50bda92d6d8e88f2a27df7c5033b42afeb1ed2676" +dependencies = [ + "cfg-if", + "cpufeatures", + "digest 0.10.3", +] + [[package]] name = "sharded-slab" version = "0.1.4" @@ -2619,7 +2659,7 @@ version = "1.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f2807892cfa58e081aa1f1111391c7a0649d4fa127a4ffbe34bcbfb35a1171a4" dependencies = [ - "digest", + "digest 0.9.0", "rand_core 0.6.3", ] @@ -3151,7 +3191,7 @@ dependencies = [ "rand_core 0.6.3", "rsa", "serde", - "sha2", + "sha2 0.9.9", "subtle", "thiserror", "xoodyak", @@ -3415,7 +3455,7 @@ dependencies = [ "pretty_env_logger", "rustix", "serde", - "sha2", + "sha2 0.10.2", "tempfile", "toml", "windows-sys", diff --git a/cranelift/codegen/Cargo.toml b/cranelift/codegen/Cargo.toml index 34f433f684..86e2808d14 100644 --- a/cranelift/codegen/Cargo.toml +++ b/cranelift/codegen/Cargo.toml @@ -27,7 +27,7 @@ gimli = { workspace = true, features = ["write"], optional = true } smallvec = { workspace = true } regalloc2 = { version = "0.4.1", features = ["checker"] } souper-ir = { version = "2.1.0", optional = true } -sha2 = { version = "0.9.0", optional = true } +sha2 = { version = "0.10.2", optional = true } # It is a goal of the cranelift-codegen crate to have minimal external dependencies. # Please don't add any unless they are essential to the task of creating binary # machine code. Integration tests that need external dependencies can be diff --git a/crates/cache/Cargo.toml b/crates/cache/Cargo.toml index 2506de38a3..3ebd15bdba 100644 --- a/crates/cache/Cargo.toml +++ b/crates/cache/Cargo.toml @@ -16,7 +16,7 @@ directories-next = "2.0" file-per-thread-logger = "0.1.1" log = { workspace = true } serde = { version = "1.0.94", features = ["derive"] } -sha2 = "0.9.0" +sha2 = "0.10.2" toml = "0.5.5" zstd = { version = "0.11.1", default-features = false } diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index fa6beaca06..2a646f3730 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -38,6 +38,11 @@ criteria = "safe-to-deploy" version = "0.3.66" notes = "I am the author of this crate." +[[audits.block-buffer]] +who = "Benjamin Bouvier " +criteria = "safe-to-deploy" +delta = "0.9.0 -> 0.10.2" + [[audits.bumpalo]] who = "Nick Fitzgerald " criteria = "safe-to-deploy" @@ -121,6 +126,11 @@ No major changes in this update, it was almost entirely stylistic with what appears to be a few clippy fixes here and there. """ +[[audits.crypto-common]] +who = "Benjamin Bouvier " +criteria = "safe-to-deploy" +version = "0.1.3" + [[audits.derive_arbitrary]] who = "Nick Fitzgerald " criteria = "safe-to-deploy" @@ -133,6 +143,11 @@ criteria = "safe-to-deploy" version = "1.1.4" notes = "I am the author of this crate." +[[audits.digest]] +who = "Benjamin Bouvier " +criteria = "safe-to-deploy" +delta = "0.9.0 -> 0.10.3" + [[audits.file-per-thread-logger]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -217,6 +232,12 @@ criteria = "safe-to-deploy" version = "0.1.21" notes = "I am the author of this crate." +[[audits.sha2]] +who = "Benjamin Bouvier " +criteria = "safe-to-deploy" +delta = "0.9.9 -> 0.10.2" +notes = "This upgrade is mostly a code refactor, as far as I can tell. No new uses of unsafe nor any new ambient capabilities usage." + [[audits.system-interface]] who = "Dan Gohman " criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 0d8651a8f7..504aa00de4 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -105,6 +105,11 @@ who = "Mike Hommey " criteria = "safe-to-deploy" delta = "0.8.8 -> 0.8.11" +[[audits.mozilla.audits.crypto-common]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "0.1.3 -> 0.1.6" + [[audits.mozilla.audits.derive_arbitrary]] who = "Mike Hommey " criteria = "safe-to-run"