From db65d20be016910c8ea361c3265083e1d728a1d5 Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Thu, 22 Oct 2026 09:44:59 -0400 Subject: [PATCH 1/5] sec: close the advisory backlog across every workspace, and move the WASM sandbox off a runtime with three critical escapes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `cargo audit` over all 47 workspace lockfiles reported 142 vulnerability instances. The dangerous ones were not exotic: the S2 executor was pinned to wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379 (9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole job is to execute untrusted guest code, so a sandbox-escape class defect there is not a dependency hygiene matter — it is the confinement claim itself. wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight advisories names as patched (50.0.0 exists but no advisory lists it as fixed, so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the constant is attested into the mechanism commitment under SPEC §7.9, so leaving it stale would attest confinement to a runtime that did not run. The crate's own `wasmtime_version_matches_the_lockfile` test enforces that pairing. The rest are semver-compatible bumps carrying no API change: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto 0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch 0.9.20, rtrb 0.3.5. Not fixed here, and deliberately so rather than silently: zip (>=9.0.0), hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all semver-major moves, three of them transitive, so each needs its dependent assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all. Co-Authored-By: Claude Opus 5 --- aac/aac-rs/Cargo.lock | 4 +- eoc/eoc-bench/Cargo.lock | 4 +- eoc/eoc-rs/Cargo.lock | 32 +- joule-code/examples/transport-moqt/Cargo.lock | 4 +- joule-code/joule-code-rs/Cargo.lock | 28 +- .../crates/joule-moq-room/Cargo.lock | 38 +- jouleclaw/jouleclaw-rs/Cargo.lock | 50 +-- jouledesk/jouledesk-rs/Cargo.lock | 34 +- joulehook/joulehook-rs/Cargo.lock | 14 +- map/map-rs/Cargo.lock | 4 +- openpay/Cargo.lock | 48 +- sandbox/sandbox-rs/Cargo.lock | 414 +++++++----------- sandbox/sandbox-rs/Cargo.toml | 2 +- .../crates/sandbox-exec-wasm/src/lib.rs | 2 +- smart-byte/smart-byte-rs/Cargo.lock | 57 +-- wai/tools/ops-gpu-bench/Cargo.lock | 4 +- wai/tools/quantum-meter/Cargo.lock | 4 +- wai/wai-ops-gpu/Cargo.lock | 4 +- wai/wai-quantum-desktop/Cargo.lock | 12 +- wai/wai-quantum-service/Cargo.lock | 4 +- wai/wai-quantum/Cargo.lock | 4 +- wai/wai-relay/Cargo.lock | 4 +- wai/wai-rs/Cargo.lock | 26 +- wai/wai-rs/fuzz/Cargo.lock | 4 +- wai/wai-spz-gen/Cargo.lock | 4 +- 25 files changed, 358 insertions(+), 447 deletions(-) diff --git a/aac/aac-rs/Cargo.lock b/aac/aac-rs/Cargo.lock index abe5dc53c..ff3fab4a9 100644 --- a/aac/aac-rs/Cargo.lock +++ b/aac/aac-rs/Cargo.lock @@ -2453,9 +2453,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", diff --git a/eoc/eoc-bench/Cargo.lock b/eoc/eoc-bench/Cargo.lock index 835c7b15a..bce8ffec6 100644 --- a/eoc/eoc-bench/Cargo.lock +++ b/eoc/eoc-bench/Cargo.lock @@ -496,9 +496,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "pin-project-lite", "tokio-macros", diff --git a/eoc/eoc-rs/Cargo.lock b/eoc/eoc-rs/Cargo.lock index 2c0f25329..123156ba3 100644 --- a/eoc/eoc-rs/Cargo.lock +++ b/eoc/eoc-rs/Cargo.lock @@ -1134,7 +1134,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2660,9 +2660,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "aws-lc-rs", "bytes", @@ -2692,7 +2692,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2989,14 +2989,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell", @@ -3046,7 +3046,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3057,9 +3057,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -3466,7 +3466,7 @@ dependencies = [ "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3569,9 +3569,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -3988,9 +3988,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -4011,7 +4011,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/joule-code/examples/transport-moqt/Cargo.lock b/joule-code/examples/transport-moqt/Cargo.lock index c7bcd8ec5..867c9a4a7 100644 --- a/joule-code/examples/transport-moqt/Cargo.lock +++ b/joule-code/examples/transport-moqt/Cargo.lock @@ -1041,9 +1041,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", diff --git a/joule-code/joule-code-rs/Cargo.lock b/joule-code/joule-code-rs/Cargo.lock index 31848a7ec..3447befc1 100644 --- a/joule-code/joule-code-rs/Cargo.lock +++ b/joule-code/joule-code-rs/Cargo.lock @@ -926,7 +926,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3138,9 +3138,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "bytes", "fastbloom", @@ -3171,7 +3171,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3404,9 +3404,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -3458,7 +3458,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3469,9 +3469,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -4113,9 +4113,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -4469,9 +4469,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -4482,7 +4482,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock b/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock index 4d9e63036..424dfbaa7 100644 --- a/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock +++ b/joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock @@ -470,9 +470,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.21" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] @@ -744,7 +744,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2334,9 +2334,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "bytes", "fastbloom", @@ -2367,7 +2367,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2595,14 +2595,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "once_cell", "ring", @@ -2652,7 +2652,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2663,9 +2663,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -3057,10 +3057,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3172,9 +3172,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -3515,9 +3515,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -3528,7 +3528,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/jouleclaw/jouleclaw-rs/Cargo.lock b/jouleclaw/jouleclaw-rs/Cargo.lock index f6290f1fc..8c874ca9d 100644 --- a/jouleclaw/jouleclaw-rs/Cargo.lock +++ b/jouleclaw/jouleclaw-rs/Cargo.lock @@ -1546,7 +1546,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2510,7 +2510,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.5", + "socket2 0.5.10", "tokio", "tower-service", "tracing", @@ -2740,7 +2740,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5575,7 +5575,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -6278,7 +6278,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls", - "socket2 0.6.5", + "socket2 0.5.10", "thiserror 2.0.20", "tokio", "tracing", @@ -6287,9 +6287,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "aws-lc-rs", "bytes", @@ -6317,9 +6317,9 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.5", + "socket2 0.5.10", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6838,14 +6838,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -6906,7 +6906,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6917,9 +6917,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -7454,10 +7454,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7655,9 +7655,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -8265,9 +8265,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -8278,14 +8278,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -8302,7 +8302,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] diff --git a/jouledesk/jouledesk-rs/Cargo.lock b/jouledesk/jouledesk-rs/Cargo.lock index ab19c9b07..b2dfee651 100644 --- a/jouledesk/jouledesk-rs/Cargo.lock +++ b/jouledesk/jouledesk-rs/Cargo.lock @@ -624,7 +624,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2034,9 +2034,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "bytes", "getrandom 0.4.3", @@ -2065,7 +2065,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2276,14 +2276,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -2318,9 +2318,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -2645,10 +2645,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2739,9 +2739,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -3090,14 +3090,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -3154,7 +3154,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/joulehook/joulehook-rs/Cargo.lock b/joulehook/joulehook-rs/Cargo.lock index 4fc5b9d59..ca35b3040 100644 --- a/joulehook/joulehook-rs/Cargo.lock +++ b/joulehook/joulehook-rs/Cargo.lock @@ -697,9 +697,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -721,9 +721,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -999,14 +999,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] diff --git a/map/map-rs/Cargo.lock b/map/map-rs/Cargo.lock index fa4ff8459..b5e614c99 100644 --- a/map/map-rs/Cargo.lock +++ b/map/map-rs/Cargo.lock @@ -1109,9 +1109,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "libc", "mio", diff --git a/openpay/Cargo.lock b/openpay/Cargo.lock index cca3c2102..88d62ecf0 100644 --- a/openpay/Cargo.lock +++ b/openpay/Cargo.lock @@ -1195,7 +1195,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] @@ -2117,7 +2117,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3128,7 +3128,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.5", + "socket2 0.5.10", "tokio", "tower-service", "tracing", @@ -5430,7 +5430,7 @@ dependencies = [ "quinn-udp", "rustc-hash 2.1.3", "rustls", - "socket2 0.6.5", + "socket2 0.5.10", "thiserror 2.0.20", "tokio", "tracing", @@ -5439,9 +5439,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.17" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "aws-lc-rs", "bytes", @@ -5469,9 +5469,9 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.5", + "socket2 0.5.10", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5976,14 +5976,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -6035,7 +6035,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6046,9 +6046,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -6661,10 +6661,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6822,9 +6822,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -7421,9 +7421,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -7434,14 +7434,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -7615,7 +7615,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]] diff --git a/sandbox/sandbox-rs/Cargo.lock b/sandbox/sandbox-rs/Cargo.lock index 78adb144f..5ed7da61c 100644 --- a/sandbox/sandbox-rs/Cargo.lock +++ b/sandbox/sandbox-rs/Cargo.lock @@ -82,15 +82,6 @@ version = "2.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" -[[package]] -name = "bitmaps" -version = "2.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "031043d04099746d8db04daf1fa424b2bc8bd69d92b25962dcde24da39ab64a2" -dependencies = [ - "typenum", -] - [[package]] name = "blake3" version = "1.8.7" @@ -199,9 +190,9 @@ checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b" [[package]] name = "cpp_demangle" -version = "0.4.5" +version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2bb79cb74d735044c972aae58ed0aaa9a837e85b01106a54c39e42e97f62253" +checksum = "0667304c32ea56cb4cd6d2d7c0cfe9a2f8041229db8c033af7f8d69492429def" dependencies = [ "cfg-if", ] @@ -226,27 +217,27 @@ dependencies = [ [[package]] name = "cranelift-assembler-x64" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "adc822414b18d1f5b1b33ce1441534e311e62fef86ebb5b9d382af857d0272c9" +checksum = "c9c587da2696fbaa58e7a2fa2e5bfdd365d0928219f36992304ac1f15e5bc254" dependencies = [ "cranelift-assembler-x64-meta", ] [[package]] name = "cranelift-assembler-x64-meta" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8c646808b06f4532478d8d6057d74f15c3322f10d995d9486e7dcea405bf521a" +checksum = "f28a60027b7556b680b051651291053ec381edf4ffbc01784997ae51a64269bb" dependencies = [ "cranelift-srcgen", ] [[package]] name = "cranelift-bforest" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b5996f01a686b2349cdb379083ec5ad3e8cb8767fb2d495d3a4f2ee4163a18d" +checksum = "62bfdb846acebfd591d601994ea283c98d525ac0bc9a84ca3f2c36bcf5b69ff1" dependencies = [ "cranelift-entity", "wasmtime-internal-core", @@ -254,9 +245,9 @@ dependencies = [ [[package]] name = "cranelift-bitset" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "523fea83273f6a985520f57788809a4de2165794d9ab00fb1254fceb4f5aa00c" +checksum = "aa9f8cc1080739d5f72b4ee7e00aff7d589f1284beaf0a19472c07878be7f299" dependencies = [ "serde", "serde_derive", @@ -265,9 +256,9 @@ dependencies = [ [[package]] name = "cranelift-codegen" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d73d1e372730b5f64ed1a2bd9f01fe4686c8ec14a28034e3084e530c8d951878" +checksum = "d85417d493ecec833b5134546b4a252c78cc0bd5be11729a35d25dcff9e4e70b" dependencies = [ "bumpalo", "cranelift-assembler-x64", @@ -279,13 +270,16 @@ dependencies = [ "cranelift-entity", "cranelift-isle", "gimli", - "hashbrown 0.16.1", + "hashbrown 0.17.1", "libm", "log", + "postcard", "pulley-interpreter", "regalloc2", "rustc-hash", "serde", + "serde_derive", + "sha2", "smallvec", "target-lexicon", "wasmtime-internal-core", @@ -293,9 +287,9 @@ dependencies = [ [[package]] name = "cranelift-codegen-meta" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b0319c18165e93dc1ebf78946a8da0b1c341c95b4a39729a69574671639bdb5f" +checksum = "d01c8ed0098360bae69ad6b82952d4247516799ce8050d45ad168d6689f4eae6" dependencies = [ "cranelift-assembler-x64-meta", "cranelift-codegen-shared", @@ -306,24 +300,24 @@ dependencies = [ [[package]] name = "cranelift-codegen-shared" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9195cd8aeecb55e401aa96b2eaa55921636e8246c127ed7908f7ef7e0d40f270" +checksum = "04f9b86d809cec9c4e88b201f1b3ed3b0347674c9ccfbb8c355228669e34be81" [[package]] name = "cranelift-control" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8976c2154b74136322befc74222ab5c7249edd7e2604f8cbef2b94975541ffb9" +checksum = "ce182038fb10b719841e65fdf5deeee258c684f63439f5be680c2be059274b58" dependencies = [ "arbitrary", ] [[package]] name = "cranelift-entity" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6038b3147c7982f4951150d5f96c7c06c1e7214b99d4b4a98607aadf8ded89d1" +checksum = "7bca812b03a7b942796391f25bc02aa70a1a007fee3ce2756490c788429e9c39" dependencies = [ "cranelift-bitset", "serde", @@ -333,11 +327,12 @@ dependencies = [ [[package]] name = "cranelift-frontend" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4cbd294abe236e23cc3d907b0936226b6a8342db7636daa9c7c72be1e323420e" +checksum = "a0c30563d2aef95e8d1a00a920199c99117b350339599f0e9487a7a1cf5d59de" dependencies = [ "cranelift-codegen", + "hashbrown 0.17.1", "log", "smallvec", "target-lexicon", @@ -345,15 +340,15 @@ dependencies = [ [[package]] name = "cranelift-isle" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5a90b6ed3aba84189352a87badeb93b2126d3724225a42dc67fdce53d1b139c" +checksum = "9c54184333a275698edb1d3bdff226131a25d47133d792aa716e47e32b8b7f05" [[package]] name = "cranelift-native" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3ec0cc1a54e22925eacf4fc3dc815f907734d3b377899d19d52bec04863e853" +checksum = "eb67a4c8a3180b5f1d77dffcd6317c05386ced42e5a31c7004523a9d99dc85c1" dependencies = [ "cranelift-codegen", "libc", @@ -362,9 +357,9 @@ dependencies = [ [[package]] name = "cranelift-srcgen" -version = "0.130.2" +version = "0.136.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "948865622f87f30907bb46fbb081b235ae63c1896a99a83c26a003305c1fa82d" +checksum = "b533db1679b4b728568bd490da6533cf50974c48a4d7534e78f1e0e02bc39769" [[package]] name = "crc32fast" @@ -854,17 +849,17 @@ name = "hashbrown" version = "0.16.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" -dependencies = [ - "foldhash", - "serde", - "serde_core", -] [[package]] name = "hashbrown" version = "0.17.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" +dependencies = [ + "foldhash", + "serde", + "serde_core", +] [[package]] name = "heck" @@ -997,20 +992,6 @@ dependencies = [ "icu_properties", ] -[[package]] -name = "im-rc" -version = "15.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af1955a75fa080c677d3972822ec4bad316169ab1cfc6c257a942c2265dbe5fe" -dependencies = [ - "bitmaps", - "rand_core", - "rand_xoshiro", - "sized-chunks", - "typenum", - "version_check", -] - [[package]] name = "indexmap" version = "2.14.0" @@ -1202,12 +1183,9 @@ checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6" [[package]] name = "mach2" -version = "0.4.3" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d640282b302c0bb0a2a8e0233ead9035e3bed871f0b7e81fe4a1ec829765db44" -dependencies = [ - "libc", -] +checksum = "dae608c151f68243f2b000364e1f7b186d9c29845f7d2d85bd31b9ad77ad552b" [[package]] name = "memchr" @@ -1281,12 +1259,12 @@ dependencies = [ [[package]] name = "object" -version = "0.38.1" +version = "0.40.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "271638cd5fa9cca89c4c304675ca658efc4e64a66c716b7cfe1afb4b9611dbbc" +checksum = "dd229a0361b9d0d4396176e02d65897f487eebeab7caa6d443855ee152ca0b9c" dependencies = [ "crc32fast", - "hashbrown 0.16.1", + "hashbrown 0.17.1", "indexmap", "memchr", ] @@ -1429,9 +1407,9 @@ dependencies = [ [[package]] name = "pulley-interpreter" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ec12fe19a9588315a49fe5704502a9c02d6a198303314b0c7c86123b06d29e5" +checksum = "5cd3de43f4f4cff536de8902097edbdf749321b97dda548f36a37918eb85bba3" dependencies = [ "cranelift-bitset", "log", @@ -1441,9 +1419,9 @@ dependencies = [ [[package]] name = "pulley-macros" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "36f7d5ef31ebf1b46cd7e722ffef934e670d7e462f49aa01cde07b9b76dca580" +checksum = "8319a8fa5269b4895957f8795861c42822bd26218e495f70060a963323d94847" dependencies = [ "proc-macro2", "quote", @@ -1495,15 +1473,6 @@ dependencies = [ "getrandom 0.2.17", ] -[[package]] -name = "rand_xoshiro" -version = "0.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f97cdb2a36ed4183de61b2f824cc45c9f1037f28afe0a322e9fff4c108b5aaa" -dependencies = [ - "rand_core", -] - [[package]] name = "rayon" version = "1.12.0" @@ -1546,6 +1515,7 @@ dependencies = [ "hashbrown 0.17.1", "log", "rustc-hash", + "serde", "smallvec", ] @@ -1630,9 +1600,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -1654,9 +1624,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -1669,12 +1639,6 @@ version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f" -[[package]] -name = "ryu" -version = "1.0.23" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f" - [[package]] name = "sandbox-attest" version = "0.1.0" @@ -1994,26 +1958,13 @@ dependencies = [ [[package]] name = "serde_spanned" -version = "1.1.1" +version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26" +checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c" dependencies = [ "serde_core", ] -[[package]] -name = "serde_yaml" -version = "0.9.34+deprecated" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" -dependencies = [ - "indexmap", - "itoa", - "ryu", - "serde", - "unsafe-libyaml", -] - [[package]] name = "sha1" version = "0.10.7" @@ -2058,16 +2009,6 @@ version = "0.3.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea" -[[package]] -name = "sized-chunks" -version = "0.6.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16d69225bde7a69b235da73377861095455d298f2b970996eec25ddbb42b3d1e" -dependencies = [ - "bitmaps", - "typenum", -] - [[package]] name = "slab" version = "0.4.12" @@ -2260,9 +2201,9 @@ dependencies = [ [[package]] name = "toml" -version = "0.9.12+spec-1.1.0" +version = "1.1.8+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863" +checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d" dependencies = [ "indexmap", "serde_core", @@ -2270,32 +2211,32 @@ dependencies = [ "toml_datetime", "toml_parser", "toml_writer", - "winnow 0.7.15", + "winnow", ] [[package]] name = "toml_datetime" -version = "0.7.5+spec-1.1.0" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347" +checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053" dependencies = [ "serde_core", ] [[package]] name = "toml_parser" -version = "1.1.3+spec-1.1.0" +version = "1.1.5+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56" +checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c" dependencies = [ - "winnow 1.0.4", + "winnow", ] [[package]] name = "toml_writer" -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" +checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770" [[package]] name = "typenum" @@ -2315,18 +2256,6 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" -[[package]] -name = "unicode-xid" -version = "0.2.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" - -[[package]] -name = "unsafe-libyaml" -version = "0.2.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" - [[package]] name = "untrusted" version = "0.9.0" @@ -2438,53 +2367,61 @@ dependencies = [ [[package]] name = "wasm-compose" -version = "0.245.1" +version = "0.258.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5fd23d12cc95c451c1306db5bc63075fbebb612bb70c53b4237b1ce5bc178343" +checksum = "27dc71f96d21a8b9153da9005c603f4f20d5781b7e6d2675ea0ca5def8713b75" dependencies = [ "anyhow", "heck", - "im-rc", "indexmap", "log", "petgraph", - "serde", - "serde_derive", - "serde_yaml", "smallvec", - "wasm-encoder 0.245.1", - "wasmparser 0.245.1", + "wasm-encoder 0.258.3", + "wasmparser 0.258.3", "wat", ] [[package]] name = "wasm-encoder" -version = "0.245.1" +version = "0.258.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f9dca005e69bf015e45577e415b9af8c67e8ee3c0e38b5b0add5aa92581ed5c" +checksum = "f64765e43c000fae008a48db8b288e175e237fc9ce20a26586836878c1bee89f" dependencies = [ "leb128fmt", - "wasmparser 0.245.1", + "wasmparser 0.258.3", ] [[package]] name = "wasm-encoder" -version = "0.258.0" +version = "0.262.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e974fe6821a8cf64575d51ea2194e2c8f77e7b66e9afe7419ce8a97f9ee0d251" +checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a" dependencies = [ "leb128fmt", - "wasmparser 0.258.0", + "wasmparser 0.262.0", +] + +[[package]] +name = "wasm-metadata" +version = "0.258.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "47e10808eb27efde692f1b1706089fe19296728bf872291f5b4e0d50fba88f2f" +dependencies = [ + "anyhow", + "indexmap", + "wasm-encoder 0.258.3", + "wasmparser 0.258.3", ] [[package]] name = "wasmparser" -version = "0.245.1" +version = "0.258.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4f08c9adee0428b7bddf3890fc27e015ac4b761cc608c822667102b8bfd6995e" +checksum = "fe9269dd817e0e7021bf534ccd9761bc2d64778b6708e41228b8439d75eaa0b1" dependencies = [ "bitflags", - "hashbrown 0.16.1", + "hashbrown 0.17.1", "indexmap", "semver", "serde", @@ -2492,9 +2429,9 @@ dependencies = [ [[package]] name = "wasmparser" -version = "0.258.0" +version = "0.262.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9a61719f93a87b16d325921e251800c4833f8fab50fa21c7de73aed50086313" +checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b" dependencies = [ "bitflags", "indexmap", @@ -2503,27 +2440,26 @@ dependencies = [ [[package]] name = "wasmprinter" -version = "0.245.1" +version = "0.258.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f41517a3716fbb8ccf46daa9c1325f760fcbff5168e75c7392288e410b91ac8" +checksum = "14a457ba8670a3db3d357c1aeac3ed4fe378a76054a221789f0df0ea507e292b" dependencies = [ "anyhow", "termcolor", - "wasmparser 0.245.1", + "wasmparser 0.258.3", ] [[package]] name = "wasmtime" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "efb1ed5899dde98357cfdcf647a4614498798719793898245b4b34e663addabf" +checksum = "36abb25de5518707e5ba96b586366b09db168d2d4976cb9dac57265a317497ea" dependencies = [ "addr2line", "async-trait", "bitflags", "bumpalo", "cc", - "cfg-if", "encoding_rs", "futures", "fxprof-processed-profile", @@ -2547,8 +2483,8 @@ dependencies = [ "target-lexicon", "tempfile", "wasm-compose", - "wasm-encoder 0.245.1", - "wasmparser 0.245.1", + "wasm-encoder 0.258.3", + "wasmparser 0.258.3", "wasmtime-environ", "wasmtime-internal-cache", "wasmtime-internal-component-macro", @@ -2560,16 +2496,16 @@ dependencies = [ "wasmtime-internal-jit-icache-coherence", "wasmtime-internal-unwinder", "wasmtime-internal-versioned-export-macros", - "wasmtime-internal-winch", "wat", "windows-sys 0.61.2", + "wit-parser", ] [[package]] name = "wasmtime-environ" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4172382dcc785c31d0e862c6780a18f5dd437914d22c4691351f965ef751c821" +checksum = "92f16a4d09fb1fbf2dcfeddb9818e1517a258e13b505b3bfdadcf47a19bf31ca" dependencies = [ "anyhow", "cpp_demangle", @@ -2577,7 +2513,7 @@ dependencies = [ "cranelift-bitset", "cranelift-entity", "gimli", - "hashbrown 0.16.1", + "hashbrown 0.17.1", "indexmap", "log", "object", @@ -2589,8 +2525,8 @@ dependencies = [ "sha2", "smallvec", "target-lexicon", - "wasm-encoder 0.245.1", - "wasmparser 0.245.1", + "wasm-encoder 0.258.3", + "wasmparser 0.258.3", "wasmprinter", "wasmtime-internal-component-util", "wasmtime-internal-core", @@ -2598,9 +2534,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-cache" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ed398988226d7aa0505ac6bb576e09532ad722d702ec4e66365d78ed695c95f" +checksum = "96e4469e885ac50f8dc06337245f9905b22c68d55416267f9afd07f7f76687be" dependencies = [ "base64", "directories-next", @@ -2618,9 +2554,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-macro" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae5ec9fff073ff13b81732d56a9515d761c245750bcda09093827f84130ebc25" +checksum = "d4fca03bd4425856574c0807d1dee16fad43f947feaf4e9ae1d2129596ee4de4" dependencies = [ "anyhow", "proc-macro2", @@ -2633,29 +2569,28 @@ dependencies = [ [[package]] name = "wasmtime-internal-component-util" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "935d9ab293ba27d1ec9aa7bc1b3a43993dbe961af2a8f23f90a11e1331b4c13f" +checksum = "4006009fc3598af4e895ab18c6c33d2c6b7c657b1bd0a755ca7ee1abef6f0c16" [[package]] name = "wasmtime-internal-core" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a3820b174f477d2a7083209d1ad5353fcdb11eaea434b2137b8681029460dd3" +checksum = "947a732ad659f42c10ec639706fc8cb1f068dd9a55eebde8a1f24dfd06dfa525" dependencies = [ "anyhow", - "hashbrown 0.16.1", + "hashbrown 0.17.1", "libm", "serde", ] [[package]] name = "wasmtime-internal-cranelift" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d1679d205caf9766c6aa309d45bb3e7c634d7725e3164404df33824b9f7c4fb7" +checksum = "fbfb8b455d524939e03df42e3e749f8e26e26ba2acd8b08fa00b3bda55686750" dependencies = [ - "cfg-if", "cranelift-codegen", "cranelift-control", "cranelift-entity", @@ -2669,7 +2604,7 @@ dependencies = [ "smallvec", "target-lexicon", "thiserror 2.0.20", - "wasmparser 0.245.1", + "wasmparser 0.258.3", "wasmtime-environ", "wasmtime-internal-core", "wasmtime-internal-unwinder", @@ -2678,12 +2613,11 @@ dependencies = [ [[package]] name = "wasmtime-internal-fiber" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1e505254058be5b0df458d670ee42d9eafe2349d04c1296e9dc01071dc20a85" +checksum = "bd8aa8711f68b2cdd94c2b85ba5c8317edaa1ac4ee0a0534b957123680239307" dependencies = [ "cc", - "cfg-if", "libc", "rustix", "wasmtime-environ", @@ -2693,9 +2627,9 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-debug" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c2e05b345f1773e59c20e6ad7298fd6857cdea245023d88bb659c96d8f0ea72" +checksum = "e873e4504faf50aa8ce255d6ea7210d87b39d5f379c2486782e2c5f179c70ca8" dependencies = [ "cc", "object", @@ -2705,11 +2639,10 @@ dependencies = [ [[package]] name = "wasmtime-internal-jit-icache-coherence" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b86701b234a4643e3f111869aa792b3a05a06e02d486ee9cb6c04dae16b52dab" +checksum = "197ab1fda5da958a5c0b8a97eb241beafc48ac568b82ef4f12f38d6866c74173" dependencies = [ - "cfg-if", "libc", "wasmtime-internal-core", "windows-sys 0.61.2", @@ -2717,11 +2650,10 @@ dependencies = [ [[package]] name = "wasmtime-internal-unwinder" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f63558d801beb83dde9b336eb4ae049019aee26627926edb32cd119d7e4c83cd" +checksum = "5577f3a5a979a7c3b1b23c1e9f13e70a8583acc8828471ec56f282117fc4952b" dependencies = [ - "cfg-if", "cranelift-codegen", "log", "object", @@ -2730,63 +2662,47 @@ dependencies = [ [[package]] name = "wasmtime-internal-versioned-export-macros" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "737c4d956fc3a848541a064afb683dd2771132a6b125be5baaf95c4379aa47df" +checksum = "f6399c9c4050ed431cf66e21c05fadd6f9731db44476f452f8c7142b4597b883" dependencies = [ "proc-macro2", "quote", "syn 2.0.119", ] -[[package]] -name = "wasmtime-internal-winch" -version = "43.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f599b79545e3bba0b7913406055ebede5bb0dabee9ba2015ef25a9f4c9f47807" -dependencies = [ - "cranelift-codegen", - "gimli", - "log", - "object", - "target-lexicon", - "wasmparser 0.245.1", - "wasmtime-environ", - "wasmtime-internal-cranelift", - "winch-codegen", -] - [[package]] name = "wasmtime-internal-wit-bindgen" -version = "43.0.2" +version = "49.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2192a77a00b9a67800c2b4e1c70fb6abca79d6b529e53a2ef9dcdcc36090330d" +checksum = "b4eaf45d4da7681d234bb6efd846b4a528b08a75384a7fc23f125d0145364b06" dependencies = [ "anyhow", "bitflags", "heck", "indexmap", + "wit-component", "wit-parser", ] [[package]] name = "wast" -version = "258.0.0" +version = "262.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97f7defc7ecca8b19ac7f824598eadd0c53985ee00c74060d65051e9da5b58a1" +checksum = "30612a0c29249b5f185888a107e8a519d920226b7d07f9d351fd094e9f75eb23" dependencies = [ "bumpalo", "leb128fmt", "memchr", "unicode-width", - "wasm-encoder 0.258.0", + "wasm-encoder 0.262.0", ] [[package]] name = "wat" -version = "1.258.0" +version = "1.262.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7555c008cca87f2ac58d9f83ccda7e7b44611093ce28eb28f052e7c78024b9bf" +checksum = "e228027f2b07bbaf946980ebbe2437fca73be6f54c40c2a8d4f42f277075f8d1" dependencies = [ "wast", ] @@ -2797,14 +2713,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -2840,25 +2756,6 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" -[[package]] -name = "winch-codegen" -version = "43.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52dbb0cf07b0dfe7b7a1ca8efb8f94ba98bd0fb144c411ea1665c78f0449e958" -dependencies = [ - "cranelift-assembler-x64", - "cranelift-codegen", - "gimli", - "regalloc2", - "smallvec", - "target-lexicon", - "thiserror 2.0.20", - "wasmparser 0.245.1", - "wasmtime-environ", - "wasmtime-internal-core", - "wasmtime-internal-cranelift", -] - [[package]] name = "windows-link" version = "0.2.1" @@ -2947,12 +2844,6 @@ version = "0.52.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" -[[package]] -name = "winnow" -version = "0.7.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945" - [[package]] name = "winnow" version = "1.0.4" @@ -2960,13 +2851,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81" [[package]] -name = "wit-parser" -version = "0.245.1" +name = "wit-component" +version = "0.258.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "330698718e82983499419494dd1e3d7811a457a9bf9f69734e8c5f07a2547929" +checksum = "f0fca88950af0c1f42bc77e17315e48798b8d68340171b6d204f62bc19a878a6" dependencies = [ "anyhow", - "hashbrown 0.16.1", + "bitflags", + "indexmap", + "log", + "serde", + "serde_derive", + "serde_json", + "wasm-encoder 0.258.3", + "wasm-metadata", + "wasmparser 0.258.3", + "wit-parser", +] + +[[package]] +name = "wit-parser" +version = "0.258.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72a2127663dcf3ee16614fb0e3c33d5c6c66fec9dad317a8b0fdd3869487a533" +dependencies = [ + "anyhow", + "hashbrown 0.17.1", "id-arena", "indexmap", "log", @@ -2974,8 +2884,8 @@ dependencies = [ "serde", "serde_derive", "serde_json", - "unicode-xid", - "wasmparser 0.245.1", + "unicode-ident", + "wasmparser 0.258.3", ] [[package]] diff --git a/sandbox/sandbox-rs/Cargo.toml b/sandbox/sandbox-rs/Cargo.toml index 5f732386b..02fb2759d 100644 --- a/sandbox/sandbox-rs/Cargo.toml +++ b/sandbox/sandbox-rs/Cargo.toml @@ -40,7 +40,7 @@ sandbox-conformance = { path = "crates/sandbox-conformance" } sandbox-proof = { path = "crates/sandbox-proof" } sandbox-build = { path = "crates/sandbox-build" } -wasmtime = "43" +wasmtime = "49" p384 = { version = "0.13", default-features = false, features = ["ecdsa", "sha384"] } p256 = { version = "0.13", default-features = false, features = ["ecdsa"] } sha2 = { version = "0.10", default-features = false } diff --git a/sandbox/sandbox-rs/crates/sandbox-exec-wasm/src/lib.rs b/sandbox/sandbox-rs/crates/sandbox-exec-wasm/src/lib.rs index 4c998a626..5a42fe5db 100644 --- a/sandbox/sandbox-rs/crates/sandbox-exec-wasm/src/lib.rs +++ b/sandbox/sandbox-rs/crates/sandbox-exec-wasm/src/lib.rs @@ -135,7 +135,7 @@ impl WasmExecutor { /// and `wasmtime_version_matches_the_lockfile` fails the build if it drifts. A /// stale value here would silently attest confinement to the wrong runtime, /// which is precisely the class of untruth §7.9 exists to prevent. -pub const WASMTIME_VERSION: &str = "43.0.2"; +pub const WASMTIME_VERSION: &str = "49.0.4"; impl Executor for WasmExecutor { fn tier(&self) -> Tier { diff --git a/smart-byte/smart-byte-rs/Cargo.lock b/smart-byte/smart-byte-rs/Cargo.lock index b37607158..f97dc2ef5 100644 --- a/smart-byte/smart-byte-rs/Cargo.lock +++ b/smart-byte/smart-byte-rs/Cargo.lock @@ -1024,9 +1024,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] @@ -1218,7 +1218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090" dependencies = [ "data-encoding", - "syn 2.0.117", + "syn 1.0.109", ] [[package]] @@ -1564,7 +1564,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2377,7 +2377,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.3", + "socket2 0.5.10", "tokio", "tower-service", "tracing", @@ -4065,7 +4065,7 @@ dependencies = [ "pin-project-lite", "rustc-hash", "rustls", - "socket2 0.6.3", + "socket2 0.5.10", "thiserror 2.0.18", "tokio", "tokio-stream", @@ -4110,7 +4110,7 @@ checksum = "78633d1fe1bde91d12bcabb230ac9edb890857414c6d44f3212e0d309525b5ff" dependencies = [ "cfg_aliases", "libc", - "socket2 0.6.3", + "socket2 0.5.10", "tracing", "windows-sys 0.61.2", ] @@ -4906,7 +4906,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls", - "socket2 0.6.3", + "socket2 0.5.10", "thiserror 2.0.18", "tokio", "tracing", @@ -4915,15 +4915,16 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.14" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "aws-lc-rs", "bytes", - "getrandom 0.3.4", + "getrandom 0.4.2", "lru-slab", - "rand 0.9.4", + "rand 0.10.1", + "rand_pcg", "ring", "rustc-hash", "rustls", @@ -4944,7 +4945,7 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.3", + "socket2 0.5.10", "tracing", "windows-sys 0.52.0", ] @@ -5342,14 +5343,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", @@ -5401,7 +5402,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -5412,9 +5413,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -5557,7 +5558,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6537,7 +6538,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6650,9 +6651,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.52.3" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -7215,18 +7216,18 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -7259,7 +7260,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/wai/tools/ops-gpu-bench/Cargo.lock b/wai/tools/ops-gpu-bench/Cargo.lock index f445fa02c..cc18def1b 100644 --- a/wai/tools/ops-gpu-bench/Cargo.lock +++ b/wai/tools/ops-gpu-bench/Cargo.lock @@ -952,9 +952,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.54.0" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "pin-project-lite", ] diff --git a/wai/tools/quantum-meter/Cargo.lock b/wai/tools/quantum-meter/Cargo.lock index 4ba2668d3..a994924b7 100644 --- a/wai/tools/quantum-meter/Cargo.lock +++ b/wai/tools/quantum-meter/Cargo.lock @@ -984,9 +984,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.2" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "pin-project-lite", ] diff --git a/wai/wai-ops-gpu/Cargo.lock b/wai/wai-ops-gpu/Cargo.lock index 39c91494c..850571340 100644 --- a/wai/wai-ops-gpu/Cargo.lock +++ b/wai/wai-ops-gpu/Cargo.lock @@ -678,9 +678,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.54.0" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "pin-project-lite", ] diff --git a/wai/wai-quantum-desktop/Cargo.lock b/wai/wai-quantum-desktop/Cargo.lock index b284cbb5a..ef406f540 100644 --- a/wai/wai-quantum-desktop/Cargo.lock +++ b/wai/wai-quantum-desktop/Cargo.lock @@ -622,7 +622,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a" dependencies = [ "quote", - "syn 3.0.9", + "syn 2.0.119", ] [[package]] @@ -979,7 +979,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2845,7 +2845,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -3766,9 +3766,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" -version = "1.54.0" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -4408,7 +4408,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/wai/wai-quantum-service/Cargo.lock b/wai/wai-quantum-service/Cargo.lock index a3499ac40..0476358dd 100644 --- a/wai/wai-quantum-service/Cargo.lock +++ b/wai/wai-quantum-service/Cargo.lock @@ -764,9 +764,9 @@ checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263" [[package]] name = "tokio" -version = "1.53.3" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", diff --git a/wai/wai-quantum/Cargo.lock b/wai/wai-quantum/Cargo.lock index 9ec87fe1b..8ee579165 100644 --- a/wai/wai-quantum/Cargo.lock +++ b/wai/wai-quantum/Cargo.lock @@ -1046,9 +1046,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.2" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "pin-project-lite", ] diff --git a/wai/wai-relay/Cargo.lock b/wai/wai-relay/Cargo.lock index 57cc42520..ce4a2a861 100644 --- a/wai/wai-relay/Cargo.lock +++ b/wai/wai-relay/Cargo.lock @@ -927,9 +927,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", diff --git a/wai/wai-rs/Cargo.lock b/wai/wai-rs/Cargo.lock index 6ce602869..e1b7d4d31 100644 --- a/wai/wai-rs/Cargo.lock +++ b/wai/wai-rs/Cargo.lock @@ -1295,7 +1295,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -3354,14 +3354,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -3411,7 +3411,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -3422,9 +3422,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -3937,7 +3937,7 @@ dependencies = [ "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -4430,18 +4430,18 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -4621,7 +4621,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/wai/wai-rs/fuzz/Cargo.lock b/wai/wai-rs/fuzz/Cargo.lock index 23d27f629..4a8beda59 100644 --- a/wai/wai-rs/fuzz/Cargo.lock +++ b/wai/wai-rs/fuzz/Cargo.lock @@ -357,9 +357,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.21" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] diff --git a/wai/wai-spz-gen/Cargo.lock b/wai/wai-spz-gen/Cargo.lock index e65d009c3..52cba7d3f 100644 --- a/wai/wai-spz-gen/Cargo.lock +++ b/wai/wai-spz-gen/Cargo.lock @@ -904,9 +904,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.1" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", -- 2.54.0 (Apple Git-157) From 031ccb235bc8e6f29be65c760c1b06fd32de2b61 Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Thu, 22 Oct 2026 09:48:55 -0400 Subject: [PATCH 2/5] =?UTF-8?q?sec:=20move=20quick-xml=20to=200.41=20where?= =?UTF-8?q?=20we=20control=20it=20=E2=80=94=20the=20ISO=2020022=20deserial?= =?UTF-8?q?izer=20parses=20counterparty=20XML?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RUSTSEC-2026-0194 (quadratic run time checking a start tag for duplicate attribute names) and -0195 (unbounded namespace-declaration allocation in `NsReader`) are both 7.5 denial-of-service defects in quick-xml. -0195 is not reachable: `NsReader` appears nowhere in the tree. -0194 is, and on a path that matters — `openpay/crates/op-iso20022/src/codec.rs` calls `quick_xml::de::from_str` on ISO 20022 messages, which arrive from payment counterparties. Attacker-shaped XML is the normal case there, not the exception, so a quadratic parse is a real availability vector on payment ingestion. Bumped 0.36 -> 0.41.0 in the four lockfiles where the version is ours to choose: openpay, jouleclaw, mesh, and the l3-jouleclaw example. Two remain pinned by dependents and cannot be fixed from here: - openpay also resolves quick-xml 0.37.5 through `open-payments-iso20022 v1.0.10`. That is the same ISO 20022 surface, so this bump hardens our own deserializer but NOT that library's internal parsing. Closing it needs an upstream release; it is not closed by this commit. - smart-byte resolves 0.39.4 through plist -> netdev -> netwatch -> iroh. That path parses macOS plists, not counterparty XML, so the exposure is materially lower. Co-Authored-By: Claude Opus 5 --- joule-code/examples/l3-jouleclaw/Cargo.lock | 4 +-- jouleclaw/jouleclaw-rs/Cargo.lock | 28 +++++++-------- jouleclaw/jouleclaw-rs/Cargo.toml | 2 +- mesh/mesh-rs/Cargo.lock | 4 +-- openpay/Cargo.lock | 38 ++++++++++----------- openpay/Cargo.toml | 2 +- 6 files changed, 39 insertions(+), 39 deletions(-) diff --git a/joule-code/examples/l3-jouleclaw/Cargo.lock b/joule-code/examples/l3-jouleclaw/Cargo.lock index 3cf0fadf5..b70010d54 100644 --- a/joule-code/examples/l3-jouleclaw/Cargo.lock +++ b/joule-code/examples/l3-jouleclaw/Cargo.lock @@ -666,9 +666,9 @@ dependencies = [ [[package]] name = "quick-xml" -version = "0.36.2" +version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe" +checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" dependencies = [ "memchr", ] diff --git a/jouleclaw/jouleclaw-rs/Cargo.lock b/jouleclaw/jouleclaw-rs/Cargo.lock index 8c874ca9d..61fcc3f78 100644 --- a/jouleclaw/jouleclaw-rs/Cargo.lock +++ b/jouleclaw/jouleclaw-rs/Cargo.lock @@ -1546,7 +1546,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -2510,7 +2510,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.5.10", + "socket2 0.6.5", "tokio", "tower-service", "tracing", @@ -2740,7 +2740,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5575,7 +5575,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -6258,9 +6258,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" [[package]] name = "quick-xml" -version = "0.36.2" +version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe" +checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" dependencies = [ "memchr", ] @@ -6278,7 +6278,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls", - "socket2 0.5.10", + "socket2 0.6.5", "thiserror 2.0.20", "tokio", "tracing", @@ -6317,9 +6317,9 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.5.10", + "socket2 0.6.5", "tracing", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6838,7 +6838,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6906,7 +6906,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -7454,10 +7454,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -8302,7 +8302,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/jouleclaw/jouleclaw-rs/Cargo.toml b/jouleclaw/jouleclaw-rs/Cargo.toml index 40f14f6e7..1999c9d55 100644 --- a/jouleclaw/jouleclaw-rs/Cargo.toml +++ b/jouleclaw/jouleclaw-rs/Cargo.toml @@ -1174,7 +1174,7 @@ base64 = "0.22" # Wave-7 — close-the-gaps deps ciborium = "0.2" # CBOR for EAT-CWT + CoRIM (IETF RATS WG canonical CBOR codec) ed25519-dalek = "2" # Ed25519 signing — rustcrypto, widely audited -quick-xml = "0.36" # Maltego TRX XML round-trip (serde-feature) +quick-xml = "0.41" # Maltego TRX XML round-trip (serde-feature) safetensors = "0.4" # HuggingFace SAE weight loader (Gemma Scope 2 alignment) # DB-grade verification + error tracking primitives (wave-4 ingest) diff --git a/mesh/mesh-rs/Cargo.lock b/mesh/mesh-rs/Cargo.lock index 97fcf7be8..00f7ddd7f 100644 --- a/mesh/mesh-rs/Cargo.lock +++ b/mesh/mesh-rs/Cargo.lock @@ -853,9 +853,9 @@ dependencies = [ [[package]] name = "quick-xml" -version = "0.36.2" +version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe" +checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" dependencies = [ "memchr", ] diff --git a/openpay/Cargo.lock b/openpay/Cargo.lock index 88d62ecf0..80253fb24 100644 --- a/openpay/Cargo.lock +++ b/openpay/Cargo.lock @@ -1195,7 +1195,7 @@ version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] @@ -2117,7 +2117,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -3128,7 +3128,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.5.10", + "socket2 0.6.5", "tokio", "tower-service", "tracing", @@ -4060,7 +4060,7 @@ dependencies = [ "chrono", "op-core", "p256", - "quick-xml 0.36.2", + "quick-xml 0.41.0", "reqwest 0.13.4", "rsa", "serde", @@ -4080,7 +4080,7 @@ dependencies = [ "chrono", "op-core", "op-iso20022", - "quick-xml 0.36.2", + "quick-xml 0.41.0", "serde", "serde_json", "thiserror 2.0.20", @@ -4344,7 +4344,7 @@ dependencies = [ "open-payments-iso20022-pacs", "open-payments-iso20022-pain", "proptest", - "quick-xml 0.36.2", + "quick-xml 0.41.0", "serde", "serde_json", "thiserror 2.0.20", @@ -4576,7 +4576,7 @@ dependencies = [ "ed25519-dalek", "op-core", "proptest", - "quick-xml 0.36.2", + "quick-xml 0.41.0", "rand_core 0.6.4", "reqwest 0.13.4", "serde", @@ -5399,9 +5399,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" [[package]] name = "quick-xml" -version = "0.36.2" +version = "0.37.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe" +checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb" dependencies = [ "memchr", "serde", @@ -5409,9 +5409,9 @@ dependencies = [ [[package]] name = "quick-xml" -version = "0.37.5" +version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb" +checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" dependencies = [ "memchr", "serde", @@ -5430,7 +5430,7 @@ dependencies = [ "quinn-udp", "rustc-hash 2.1.3", "rustls", - "socket2 0.5.10", + "socket2 0.6.5", "thiserror 2.0.20", "tokio", "tracing", @@ -5469,9 +5469,9 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.5.10", + "socket2 0.6.5", "tracing", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -5976,7 +5976,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6035,7 +6035,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -6661,10 +6661,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.61.2", ] [[package]] @@ -7615,7 +7615,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/openpay/Cargo.toml b/openpay/Cargo.toml index c3f378a40..b85521598 100644 --- a/openpay/Cargo.toml +++ b/openpay/Cargo.toml @@ -76,7 +76,7 @@ open-payments-iso20022 = { version = "=1.0.10", features = ["payments"] } open-payments-fednow = "=1.0.9" # XML codec — quick-xml is the de-facto choice; we use it for round-trip # validation against XSD-canonical sample files. -quick-xml = { version = "0.36", features = ["serialize"] } +quick-xml = { version = "0.41", features = ["serialize"] } # ML / inference burn = { version = "0.18", default-features = false } -- 2.54.0 (Apple Git-157) From f42cb4fae18cbff11e8f8c90567e6f80242d343d Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Thu, 22 Oct 2026 09:50:04 -0400 Subject: [PATCH 3/5] sec: drop the unused rsa dependency from op-3ds2, removing the one advisory with no fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RUSTSEC-2023-0071 (Marvin attack: key recovery through timing sidechannels in RSA decryption) is the only finding in this sweep with **no fixed version available** — there is nothing to upgrade to. It needed neither a mitigation nor a risk acceptance, because the dependency was never used. `rsa::`, `use rsa` and `extern crate rsa` appear in none of op-3ds2's 20 source files, nor anywhere else in the openpay workspace. The declaration described an intent ("RSA for legacy issuer ACS public keys") that was never implemented; the only asymmetric crypto actually present is P-256 ECDH/ECDSA. Removing the line drops rsa 0.9.10 and pkcs1 0.7.5 from the graph. The adjacent comment still advertised RSA support, which would now mislead a reader into thinking it was dropped rather than never built. It is rewritten to say so, and to record that the crate cannot simply be re-added: the Marvin defect is unfixed upstream, so a future legacy-ACS path needs a constant-time implementation, not a version bump. Co-Authored-By: Claude Opus 5 --- openpay/Cargo.lock | 1004 ++++++++++++----------------- openpay/crates/op-3ds2/Cargo.toml | 10 +- 2 files changed, 420 insertions(+), 594 deletions(-) diff --git a/openpay/Cargo.lock b/openpay/Cargo.lock index 80253fb24..51742c5dc 100644 --- a/openpay/Cargo.lock +++ b/openpay/Cargo.lock @@ -58,17 +58,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "ahash" -version = "0.7.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9" -dependencies = [ - "getrandom 0.2.17", - "once_cell", - "version_check", -] - [[package]] name = "ahash" version = "0.8.12" @@ -163,9 +152,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "arbitrary" -version = "1.4.2" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" +checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed" dependencies = [ "derive_arbitrary", ] @@ -206,7 +195,7 @@ dependencies = [ "nom", "num-traits", "rusticata-macros", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", ] @@ -219,7 +208,7 @@ dependencies = [ "proc-macro2", "quote", "syn 2.0.119", - "synstructure", + "synstructure 0.13.2", ] [[package]] @@ -421,7 +410,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] @@ -453,9 +442,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-rs" -version = "1.18.0" +version = "1.18.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e" +checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13" dependencies = [ "aws-lc-sys", "zeroize", @@ -463,9 +452,9 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.44.0" +version = "0.46.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483" +checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc" dependencies = [ "cc", "cmake", @@ -487,7 +476,7 @@ dependencies = [ "http 1.5.0", "http-body 1.1.0", "http-body-util", - "hyper 1.11.0", + "hyper 1.12.0", "hyper-util", "itoa", "matchit", @@ -544,6 +533,12 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "base64" +version = "0.23.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" + [[package]] name = "base64ct" version = "1.8.3" @@ -589,6 +584,15 @@ dependencies = [ "bit-vec 0.8.0", ] +[[package]] +name = "bit-set" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c" +dependencies = [ + "bit-vec 0.10.1", +] + [[package]] name = "bit-vec" version = "0.6.3" @@ -601,6 +605,16 @@ version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" +[[package]] +name = "bit-vec" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269" +dependencies = [ + "borsh", + "serde", +] + [[package]] name = "bitflags" version = "1.3.2" @@ -609,25 +623,13 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" [[package]] name = "bitflags" -version = "2.13.1" +version = "2.13.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" +checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06" dependencies = [ "serde_core", ] -[[package]] -name = "bitvec" -version = "1.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837" -dependencies = [ - "funty", - "radium", - "tap", - "wyz", -] - [[package]] name = "blake3" version = "1.8.7" @@ -638,7 +640,7 @@ dependencies = [ "cc", "cfg-if", "constant_time_eq", - "cpufeatures 0.3.0", + "cpufeatures 0.3.1", ] [[package]] @@ -680,9 +682,9 @@ dependencies = [ [[package]] name = "borsh" -version = "1.8.0" +version = "1.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a88b7ea17d208c4193f2c1e6de3c35fe71f98c96982d5ced308bdcc749ff6e1f" +checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a" dependencies = [ "borsh-derive", "bytes", @@ -691,15 +693,15 @@ dependencies = [ [[package]] name = "borsh-derive" -version = "1.8.0" +version = "1.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d8f347189c62a579b8cd5f80714efa178f52e461dc2e6d701d264f5ff22e566c" +checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56" dependencies = [ "once_cell", "proc-macro-crate", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.9", ] [[package]] @@ -769,7 +771,7 @@ version = "0.17.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2afa81c868c1a9b3fad25c31176945d0cc5181ba7b77c0456bc05cf57fca975c" dependencies = [ - "ahash 0.8.12", + "ahash", "bincode", "burn-common", "burn-derive", @@ -936,28 +938,6 @@ dependencies = [ "cubecl", ] -[[package]] -name = "bytecheck" -version = "0.6.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23cdc57ce23ac53c931e88a43d06d070a6fd142f2617be5855eb75efc9beb1c2" -dependencies = [ - "bytecheck_derive", - "ptr_meta", - "simdutf8", -] - -[[package]] -name = "bytecheck_derive" -version = "0.6.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3db406d29fbcd95542e92559bed4d8ad92636d1ca8b3b72ede10b4bcc010e659" -dependencies = [ - "proc-macro2", - "quote", - "syn 1.0.109", -] - [[package]] name = "bytemuck" version = "1.25.2" @@ -969,13 +949,13 @@ dependencies = [ [[package]] name = "bytemuck_derive" -version = "1.12.0" +version = "1.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f" +checksum = "6a1f896587b6f2c069c73d2f0913e2d590c3990285cd2f0b6aa02b786b4c679c" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] @@ -1020,9 +1000,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5" [[package]] name = "cc" -version = "1.4.4" +version = "1.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273" +checksum = "877bf67ac8e52449eb2f9e98a344ea163beb70dd1f9eebe3cc5357dcfeaee4df" dependencies = [ "find-msvc-tools", "jobserver", @@ -1038,9 +1018,9 @@ checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" [[package]] name = "cfg-if" -version = "1.0.4" +version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" +checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" [[package]] name = "cfg_aliases" @@ -1050,12 +1030,12 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" [[package]] name = "chacha20" -version = "0.10.1" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures 0.3.1", "rand_core 0.10.1", ] @@ -1110,9 +1090,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.6.6" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca" +checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946" dependencies = [ "clap_builder", "clap_derive", @@ -1120,9 +1100,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.6" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889" +checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d" dependencies = [ "anstream", "anstyle", @@ -1132,21 +1112,21 @@ dependencies = [ [[package]] name = "clap_derive" -version = "4.6.4" +version = "4.6.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061" +checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0" dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] name = "clap_lex" -version = "1.1.0" +version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" +checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486" [[package]] name = "cmake" @@ -1169,7 +1149,7 @@ version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1" dependencies = [ - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -1200,9 +1180,9 @@ dependencies = [ [[package]] name = "combine" -version = "4.6.8" +version = "4.6.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e" +checksum = "4356eba6976435498d05a311ee9fc486da3bc81c200d3f0d7dd9703b41913f92" dependencies = [ "bytes", "memchr", @@ -1219,9 +1199,9 @@ dependencies = [ [[package]] name = "console" -version = "0.16.4" +version = "0.16.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c" +checksum = "e96a4956774c13c126a8b5af4daa79384f4d826534c95a02d76afb39e2ab64e3" dependencies = [ "encode_unicode", "libc", @@ -1293,6 +1273,12 @@ dependencies = [ "libc", ] +[[package]] +name = "core_detect" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48" + [[package]] name = "cpufeatures" version = "0.2.17" @@ -1304,18 +1290,18 @@ dependencies = [ [[package]] name = "cpufeatures" -version = "0.3.0" +version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566" dependencies = [ "libc", ] [[package]] name = "crc32fast" -version = "1.5.1" +version = "1.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550" +checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055" dependencies = [ "cfg-if", ] @@ -1328,18 +1314,18 @@ checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" [[package]] name = "crossbeam-channel" -version = "0.5.16" +version = "0.5.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e" +checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1" dependencies = [ "crossbeam-utils", ] [[package]] name = "crossbeam-deque" -version = "0.8.7" +version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb" +checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a" dependencies = [ "crossbeam-epoch", "crossbeam-utils", @@ -1347,18 +1333,18 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.20" +version = "0.9.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" +checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" dependencies = [ "crossbeam-utils", ] [[package]] name = "crossbeam-utils" -version = "0.8.22" +version = "0.8.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17" +checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6" [[package]] name = "crunchy" @@ -1409,9 +1395,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574" dependencies = [ "cmov", ] @@ -1463,7 +1449,7 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b03bf4211cdbd68bb0fb8291e0ed825c13da0d1ac01b7c02dce3cee44a6138be" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "bytemuck", "cubecl-common", "cubecl-ir", @@ -1778,7 +1764,7 @@ dependencies = [ "hex", "k256", "op-rails-crypto", - "reqwest 0.13.4", + "reqwest 0.13.5", "serde", "serde_json", "sha3", @@ -1814,9 +1800,9 @@ dependencies = [ [[package]] name = "deranged" -version = "0.5.8" +version = "0.5.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" +checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e" dependencies = [ "serde_core", ] @@ -1845,13 +1831,13 @@ dependencies = [ [[package]] name = "derive_arbitrary" -version = "1.4.2" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" +checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.9", ] [[package]] @@ -1949,7 +1935,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] @@ -2034,9 +2020,9 @@ dependencies = [ [[package]] name = "either" -version = "1.18.0" +version = "1.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34" +checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be" [[package]] name = "elliptic-curve" @@ -2106,9 +2092,9 @@ dependencies = [ [[package]] name = "equivalent" -version = "1.0.2" +version = "1.0.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" +checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826" [[package]] name = "errno" @@ -2170,9 +2156,9 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" [[package]] name = "find-msvc-tools" -version = "0.1.11" +version = "0.1.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890" +checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48" [[package]] name = "fixedbitset" @@ -2182,12 +2168,13 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80" [[package]] name = "flate2" -version = "1.1.9" +version = "1.1.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c" +checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb" dependencies = [ "crc32fast", "miniz_oxide", + "zlib-rs", ] [[package]] @@ -2226,7 +2213,7 @@ checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] @@ -2250,12 +2237,6 @@ version = "1.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" -[[package]] -name = "funty" -version = "2.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c" - [[package]] name = "futures" version = "0.3.34" @@ -2325,7 +2306,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] @@ -2704,7 +2685,7 @@ version = "0.6.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "45cf04b2726f02df5508c6de726acdc90cdf97ac771a9a0ffd8ba10a6e696bf9" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "gpu-alloc-types", ] @@ -2714,7 +2695,7 @@ version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b2bbed164dd10ed526c2e4fe3e721ca4a71c61730e5aafac6844b417b3227058" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", ] [[package]] @@ -2735,7 +2716,7 @@ version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b89c83349105e3732062a895becfc71a8f921bb71ecbbdd8ff99263e3b53a0ca" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "gpu-descriptor-types", "hashbrown 0.15.5", ] @@ -2746,7 +2727,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fdf242682df893b86f33a73828fb09ca4b2d3bb6cc95249707fc684d27484b91" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", ] [[package]] @@ -2762,9 +2743,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.19" +version = "0.4.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16" +checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118" dependencies = [ "atomic-waker", "bytes", @@ -2804,22 +2785,13 @@ dependencies = [ "byteorder", ] -[[package]] -name = "hashbrown" -version = "0.12.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888" -dependencies = [ - "ahash 0.7.8", -] - [[package]] name = "hashbrown" version = "0.13.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e" dependencies = [ - "ahash 0.8.12", + "ahash", ] [[package]] @@ -2828,7 +2800,7 @@ version = "0.14.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" dependencies = [ - "ahash 0.8.12", + "ahash", "allocator-api2", "serde", ] @@ -2882,9 +2854,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" [[package]] name = "hermit-abi" -version = "0.5.2" +version = "0.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" +checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284" [[package]] name = "hex" @@ -3031,9 +3003,9 @@ dependencies = [ [[package]] name = "hybrid-array" -version = "0.4.14" +version = "0.4.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b" +checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17" dependencies = [ "typenum", ] @@ -3063,9 +3035,9 @@ dependencies = [ [[package]] name = "hyper" -version = "1.11.0" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72" +checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c" dependencies = [ "atomic-waker", "bytes", @@ -3085,12 +3057,12 @@ dependencies = [ [[package]] name = "hyper-rustls" -version = "0.27.9" +version = "0.27.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f" +checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53" dependencies = [ "http 1.5.0", - "hyper 1.11.0", + "hyper 1.12.0", "hyper-util", "rustls", "tokio", @@ -3104,7 +3076,7 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0" dependencies = [ - "hyper 1.11.0", + "hyper 1.12.0", "hyper-util", "pin-project-lite", "tokio", @@ -3113,17 +3085,18 @@ dependencies = [ [[package]] name = "hyper-util" -version = "0.1.20" +version = "0.1.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0" +checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "bytes", "futures-channel", "futures-util", "http 1.5.0", "http-body 1.1.0", - "hyper 1.11.0", + "httparse", + "hyper 1.12.0", "ipnet", "libc", "percent-encoding", @@ -3160,23 +3133,23 @@ dependencies = [ [[package]] name = "icu_collections" -version = "2.3.0" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513" +checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd" dependencies = [ "displaydoc", "potential_utf", "utf8_iter", - "yoke 0.8.3", + "yoke 0.8.4", "zerofrom", "zerovec", ] [[package]] name = "icu_locale_core" -version = "2.3.0" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb" +checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0" dependencies = [ "displaydoc", "litemap", @@ -3187,9 +3160,9 @@ dependencies = [ [[package]] name = "icu_normalizer" -version = "2.3.0" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f" +checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599" dependencies = [ "icu_collections", "icu_normalizer_data", @@ -3201,15 +3174,15 @@ dependencies = [ [[package]] name = "icu_normalizer_data" -version = "2.3.0" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0" +checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc" [[package]] name = "icu_properties" -version = "2.3.0" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148" +checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f" dependencies = [ "displaydoc", "icu_collections", @@ -3222,20 +3195,20 @@ dependencies = [ [[package]] name = "icu_properties_data" -version = "2.3.0" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa" +checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf" [[package]] name = "icu_provider" -version = "2.3.1" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73" +checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514" dependencies = [ "displaydoc", "icu_locale_core", "writeable", - "yoke 0.8.3", + "yoke 0.8.4", "zerofrom", "zerotrie", "zerovec", @@ -3270,9 +3243,9 @@ dependencies = [ [[package]] name = "indexmap" -version = "2.14.0" +version = "2.14.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9" +checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855" dependencies = [ "equivalent", "hashbrown 0.17.1", @@ -3289,9 +3262,9 @@ dependencies = [ [[package]] name = "insta" -version = "1.48.0" +version = "1.49.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82" +checksum = "b67d3d2e287e4b86c10b3f3b641033d1f89b74bdb39d05f34952e2b9a6fe21cd" dependencies = [ "console", "once_cell", @@ -3301,9 +3274,9 @@ dependencies = [ [[package]] name = "ipnet" -version = "2.12.1" +version = "2.12.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78" +checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0" [[package]] name = "is_terminal_polyfill" @@ -3374,7 +3347,7 @@ dependencies = [ "jni-sys 0.4.1", "log", "simd_cesu8", - "thiserror 2.0.20", + "thiserror 2.0.21", "walkdir", "windows-link", ] @@ -3432,9 +3405,9 @@ dependencies = [ [[package]] name = "js-sys" -version = "0.3.104" +version = "0.3.106" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a" +checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5" dependencies = [ "cfg-if", "futures-util", @@ -3535,12 +3508,9 @@ dependencies = [ [[package]] name = "lazy_static" -version = "1.5.0" +version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" -dependencies = [ - "spin 0.9.9", -] +checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb" [[package]] name = "levenshtein" @@ -3550,9 +3520,9 @@ checksum = "db13adb97ab515a3691f56e4dbab09283d0b86cb45abd991d8634a9d6f501760" [[package]] name = "libc" -version = "0.2.189" +version = "0.2.191" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" +checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a" [[package]] name = "libloading" @@ -3582,9 +3552,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981" [[package]] name = "libredox" -version = "0.1.20" +version = "0.1.25" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "28d0a00925a9f930d679b6789b721e3a7f9ed110f41b86d2497caa780c3a070a" +checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d" dependencies = [ "libc", ] @@ -3603,9 +3573,9 @@ checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae" [[package]] name = "litrs" -version = "1.0.0" +version = "1.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092" +checksum = "4744e383959f0db86ede514b809b1c53251889093803c05267acc7d4e7030d70" [[package]] name = "lock_api" @@ -3627,9 +3597,9 @@ dependencies = [ [[package]] name = "lru-slab" -version = "0.1.2" +version = "0.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" +checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f" [[package]] name = "macerator" @@ -3710,9 +3680,9 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98" [[package]] name = "memmap2" -version = "0.9.11" +version = "0.9.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0" +checksum = "6b0ca1155a9ecc25aa12e8313a119f32edf0255fea2f44839c4ac0a12b2ac157" dependencies = [ "libc", "stable_deref_trait", @@ -3724,7 +3694,7 @@ version = "0.31.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f569fb946490b5743ad69813cb19629130ce9374034abe31614a36402d18f99e" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "block", "core-graphics-types", "foreign-types", @@ -3741,9 +3711,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a" [[package]] name = "minicov" -version = "0.3.9" +version = "0.3.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3aa3aa12b448ac225b3102217d1ac5cc717908f02722926524b0599c933c7a0" +checksum = "4869b6a491569605d66d3952bcdf03df789e5b536e5f0cf7758a7f08a55ae24d" dependencies = [ "cc", "walkdir", @@ -3772,9 +3742,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a" [[package]] name = "miniz_oxide" -version = "0.8.9" +version = "0.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316" +checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c" dependencies = [ "adler2", "simd-adler32", @@ -3782,9 +3752,9 @@ dependencies = [ [[package]] name = "mio" -version = "1.2.2" +version = "1.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427" +checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee" dependencies = [ "libc", "wasi", @@ -3805,7 +3775,7 @@ checksum = "2b977c445f26e49757f9aca3631c3b8b836942cb278d69a92e7b80d3b24da632" dependencies = [ "arrayvec", "bit-set 0.8.0", - "bitflags 2.13.1", + "bitflags 2.13.2", "cfg_aliases", "codespan-reporting", "half", @@ -3818,7 +3788,7 @@ dependencies = [ "rustc-hash 1.1.0", "spirv", "strum", - "thiserror 2.0.20", + "thiserror 2.0.21", "unicode-ident", ] @@ -3911,22 +3881,6 @@ dependencies = [ "num-traits", ] -[[package]] -name = "num-bigint-dig" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7" -dependencies = [ - "lazy_static", - "libm", - "num-integer", - "num-iter", - "num-traits", - "rand 0.8.8", - "smallvec", - "zeroize", -] - [[package]] name = "num-complex" version = "0.4.6" @@ -3993,28 +3947,6 @@ dependencies = [ "libc", ] -[[package]] -name = "num_enum" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26" -dependencies = [ - "num_enum_derive", - "rustversion", -] - -[[package]] -name = "num_enum_derive" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8" -dependencies = [ - "proc-macro-crate", - "proc-macro2", - "quote", - "syn 2.0.119", -] - [[package]] name = "objc" version = "0.2.7" @@ -4061,12 +3993,11 @@ dependencies = [ "op-core", "p256", "quick-xml 0.41.0", - "reqwest 0.13.4", - "rsa", + "reqwest 0.13.5", "serde", "serde_json", - "sha2 0.11.0", - "thiserror 2.0.20", + "sha2 0.11.1", + "thiserror 2.0.21", "tokio", "tracing", "uuid", @@ -4083,7 +4014,7 @@ dependencies = [ "quick-xml 0.41.0", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tracing", ] @@ -4093,7 +4024,7 @@ version = "0.1.0" dependencies = [ "proptest", "serde", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4106,12 +4037,12 @@ dependencies = [ "hex", "hmac 0.13.0", "op-core", - "reqwest 0.13.4", + "reqwest 0.13.5", "serde", "serde_json", - "sha2 0.11.0", + "sha2 0.11.1", "subtle", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tracing", "wiremock", @@ -4127,10 +4058,10 @@ dependencies = [ "op-graph", "op-ledger", "op-server", - "reqwest 0.13.4", + "reqwest 0.13.5", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "tokio", "uuid", @@ -4144,10 +4075,10 @@ dependencies = [ "chrono", "op-core", "op-screening", - "reqwest 0.13.4", + "reqwest 0.13.5", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tracing", "uuid", @@ -4162,7 +4093,7 @@ dependencies = [ "serde", "serde_json", "subtle", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "uuid", "zeroize", @@ -4176,7 +4107,7 @@ dependencies = [ "serde", "serde_json", "sha3", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4188,7 +4119,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "uuid", ] @@ -4201,7 +4132,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "uuid", ] @@ -4217,7 +4148,7 @@ dependencies = [ "op-rails-crypto", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", ] @@ -4228,7 +4159,7 @@ dependencies = [ "op-core", "proptest", "serde", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4240,9 +4171,9 @@ dependencies = [ "op-core", "serde", "serde_json", - "sha2 0.11.0", + "sha2 0.11.1", "subtle", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "tracing", ] @@ -4254,7 +4185,7 @@ dependencies = [ "jni 0.21.1", "op-fraud", "op-vault", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4265,7 +4196,7 @@ dependencies = [ "op-vault", "swift-bridge", "swift-bridge-build", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4281,8 +4212,8 @@ dependencies = [ "proptest", "serde", "serde_json", - "sha2 0.11.0", - "thiserror 2.0.20", + "sha2 0.11.1", + "thiserror 2.0.21", "time", ] @@ -4292,8 +4223,8 @@ version = "0.1.0" dependencies = [ "proptest", "serde", - "sha2 0.11.0", - "thiserror 2.0.20", + "sha2 0.11.1", + "thiserror 2.0.21", "time", ] @@ -4305,7 +4236,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4325,7 +4256,7 @@ dependencies = [ "serde", "serde_json", "tempfile", - "thiserror 2.0.20", + "thiserror 2.0.21", "uuid", ] @@ -4347,7 +4278,7 @@ dependencies = [ "quick-xml 0.41.0", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "uuid", ] @@ -4359,7 +4290,7 @@ dependencies = [ "op-core", "proptest", "serde", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4368,7 +4299,7 @@ version = "0.1.0" dependencies = [ "op-core", "serde", - "thiserror 2.0.20", + "thiserror 2.0.21", "tracing", "uuid", ] @@ -4390,9 +4321,9 @@ dependencies = [ "proptest", "serde", "serde_json", - "sha2 0.11.0", + "sha2 0.11.1", "subtle", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "zeroize", ] @@ -4404,7 +4335,7 @@ dependencies = [ "op-core", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "tracing", "uuid", @@ -4425,8 +4356,8 @@ dependencies = [ "opentelemetry_sdk", "serde", "serde_json", - "sha2 0.11.0", - "thiserror 2.0.20", + "sha2 0.11.1", + "thiserror 2.0.21", "tracing", "tracing-opentelemetry", "tracing-subscriber", @@ -4442,7 +4373,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "uuid", ] @@ -4459,7 +4390,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "ureq", "uuid", @@ -4477,7 +4408,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "ureq", "uuid", @@ -4492,12 +4423,12 @@ dependencies = [ "k256", "op-core", "proptest", - "reqwest 0.13.4", + "reqwest 0.13.5", "rlp", "serde", "serde_json", "sha3", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4507,7 +4438,7 @@ dependencies = [ "op-core", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4521,7 +4452,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "tracing", ] @@ -4535,7 +4466,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "uuid", ] @@ -4549,7 +4480,7 @@ dependencies = [ "rust_decimal", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tracing", "uuid", @@ -4563,7 +4494,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", ] [[package]] @@ -4578,10 +4509,10 @@ dependencies = [ "proptest", "quick-xml 0.41.0", "rand_core 0.6.4", - "reqwest 0.13.4", + "reqwest 0.13.5", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tracing", "unicode-normalization", @@ -4610,7 +4541,7 @@ dependencies = [ "op-webhook", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tower", "tower-http", @@ -4628,7 +4559,7 @@ dependencies = [ "op-ledger", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tracing", "uuid", ] @@ -4640,7 +4571,7 @@ dependencies = [ "op-core", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tracing", "uuid", ] @@ -4653,7 +4584,7 @@ dependencies = [ "proptest", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "tracing", "uuid", @@ -4668,11 +4599,11 @@ dependencies = [ "ciborium", "op-core", "proptest", - "reqwest 0.13.4", + "reqwest 0.13.5", "rust_decimal", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tracing", "wiremock", @@ -4688,7 +4619,7 @@ dependencies = [ "rand_core 0.6.4", "serde", "serde_json", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", "uuid", "zeroize", @@ -4702,7 +4633,7 @@ dependencies = [ "getrandom 0.2.17", "op-fraud", "op-vault", - "thiserror 2.0.20", + "thiserror 2.0.21", "wasm-bindgen", "wasm-bindgen-test", ] @@ -4713,11 +4644,11 @@ version = "0.1.0" dependencies = [ "hmac 0.13.0", "op-core", - "reqwest 0.13.4", + "reqwest 0.13.5", "serde", - "sha2 0.11.0", + "sha2 0.11.1", "subtle", - "thiserror 2.0.20", + "thiserror 2.0.21", "tracing", "uuid", ] @@ -4898,7 +4829,7 @@ dependencies = [ "futures-sink", "js-sys", "pin-project-lite", - "thiserror 2.0.20", + "thiserror 2.0.21", "tracing", ] @@ -4928,7 +4859,7 @@ dependencies = [ "opentelemetry_sdk", "prost", "reqwest 0.12.28", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tonic", "tracing", @@ -4959,7 +4890,7 @@ dependencies = [ "opentelemetry", "percent-encoding", "rand 0.9.5", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tokio-stream", ] @@ -4981,9 +4912,9 @@ dependencies = [ [[package]] name = "ort" -version = "2.0.0-rc.13" +version = "2.0.0-rc.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4336a1e2b38848325241c72889086886004e589b7c74f335e60a8e8db5138a0b" +checksum = "37c87aa7a90b7ff3e0fe36cccd475df8d67f15f07f4d6c370c4b38464232813c" dependencies = [ "libloading 0.9.0", "ndarray 0.17.2", @@ -4994,9 +4925,9 @@ dependencies = [ [[package]] name = "ort-sys" -version = "2.0.0-rc.13" +version = "2.0.0-rc.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf211e3776eea6aec988552fa118dd746d70e1b1e5e244058d1c98015f3e5872" +checksum = "8d22b0417f1838db5a3ac0b3f98dfe39f6fb73624aa0a27c6bbb5040b9c7db2b" [[package]] name = "p256" @@ -5125,9 +5056,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" [[package]] name = "pin-utils" -version = "0.1.0" +version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" +checksum = "13bee6c73da26345c729282832b60b0363cf3dd9f4bfd81d8551b7a1c889a113" [[package]] name = "piper" @@ -5140,17 +5071,6 @@ dependencies = [ "futures-io", ] -[[package]] -name = "pkcs1" -version = "0.7.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" -dependencies = [ - "der", - "pkcs8", - "spki", -] - [[package]] name = "pkcs8" version = "0.10.2" @@ -5204,9 +5124,9 @@ dependencies = [ [[package]] name = "portable-atomic-util" -version = "0.2.7" +version = "0.2.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618" +checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715" dependencies = [ "portable-atomic", ] @@ -5235,9 +5155,9 @@ dependencies = [ [[package]] name = "powerfmt" -version = "0.2.0" +version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" +checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958" [[package]] name = "ppv-lite86" @@ -5305,16 +5225,17 @@ checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5" [[package]] name = "proptest" -version = "1.11.0" +version = "1.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744" +checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0" dependencies = [ - "bit-set 0.8.0", - "bit-vec 0.8.0", - "bitflags 2.13.1", + "bit-set 0.11.1", + "bit-vec 0.10.1", + "bitflags 2.13.2", + "chacha20", + "core_detect", "num-traits", - "rand 0.9.5", - "rand_chacha 0.9.0", + "rand 0.10.3", "rand_xorshift", "regex-syntax", "rusty-fork", @@ -5345,26 +5266,6 @@ dependencies = [ "syn 2.0.119", ] -[[package]] -name = "ptr_meta" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0738ccf7ea06b608c10564b31debd4f5bc5e197fc8bfe088f68ae5ce81e7a4f1" -dependencies = [ - "ptr_meta_derive", -] - -[[package]] -name = "ptr_meta_derive" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16b845dbfca988fa33db069c0e230574d15a3088f147a87b64c7589eb662c9ac" -dependencies = [ - "proc-macro2", - "quote", - "syn 1.0.109", -] - [[package]] name = "pulp" version = "0.18.22" @@ -5419,9 +5320,9 @@ dependencies = [ [[package]] name = "quinn" -version = "0.11.11" +version = "0.11.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8" +checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11" dependencies = [ "bytes", "cfg_aliases", @@ -5431,7 +5332,7 @@ dependencies = [ "rustc-hash 2.1.3", "rustls", "socket2 0.6.5", - "thiserror 2.0.20", + "thiserror 2.0.21", "tokio", "tracing", "web-time", @@ -5439,22 +5340,22 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.18" +version = "0.11.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" +checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe" dependencies = [ "aws-lc-rs", "bytes", "getrandom 0.4.3", "lru-slab", - "rand 0.10.2", + "rand 0.10.3", "rand_pcg", "ring", "rustc-hash 2.1.3", "rustls", "rustls-pki-types", "slab", - "thiserror 2.0.20", + "thiserror 2.0.21", "tinyvec", "tracing", "web-time", @@ -5462,9 +5363,9 @@ dependencies = [ [[package]] name = "quinn-udp" -version = "0.5.15" +version = "0.5.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694" +checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016" dependencies = [ "cfg_aliases", "libc", @@ -5495,12 +5396,6 @@ version = "6.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" -[[package]] -name = "radium" -version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09" - [[package]] name = "rand" version = "0.8.8" @@ -5524,9 +5419,9 @@ dependencies = [ [[package]] name = "rand" -version = "0.10.2" +version = "0.10.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" +checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af" dependencies = [ "chacha20", "getrandom 0.4.3", @@ -5598,11 +5493,11 @@ dependencies = [ [[package]] name = "rand_xorshift" -version = "0.4.0" +version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a" +checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf" dependencies = [ - "rand_core 0.9.5", + "rand_core 0.10.1", ] [[package]] @@ -5626,7 +5521,7 @@ version = "11.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", ] [[package]] @@ -5673,7 +5568,7 @@ version = "0.5.18" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", ] [[package]] @@ -5722,15 +5617,6 @@ version = "0.8.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4" -[[package]] -name = "rend" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "71fe3824f5629716b1589be05dacd749f6aa084c87e00e016714a8cdfccc997c" -dependencies = [ - "bytecheck", -] - [[package]] name = "renderdoc-sys" version = "1.1.0" @@ -5751,7 +5637,7 @@ dependencies = [ "http 1.5.0", "http-body 1.1.0", "http-body-util", - "hyper 1.11.0", + "hyper 1.12.0", "hyper-util", "js-sys", "log", @@ -5773,11 +5659,11 @@ dependencies = [ [[package]] name = "reqwest" -version = "0.13.4" +version = "0.13.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3" +checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029" dependencies = [ - "base64 0.22.1", + "base64 0.23.1", "bytes", "futures-channel", "futures-core", @@ -5785,7 +5671,7 @@ dependencies = [ "http 1.5.0", "http-body 1.1.0", "http-body-util", - "hyper 1.11.0", + "hyper 1.12.0", "hyper-rustls", "hyper-util", "js-sys", @@ -5835,35 +5721,6 @@ dependencies = [ "windows-sys 0.52.0", ] -[[package]] -name = "rkyv" -version = "0.7.46" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2297bf9c81a3f0dc96bc9521370b88f054168c29826a75e89c55ff196e7ed6a1" -dependencies = [ - "bitvec", - "bytecheck", - "bytes", - "hashbrown 0.12.3", - "ptr_meta", - "rend", - "rkyv_derive", - "seahash", - "tinyvec", - "uuid", -] - -[[package]] -name = "rkyv_derive" -version = "0.7.46" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84d7b42d4b8d06048d3ac8db0eb31bcb942cbeb709f0b5f2b2ebde398d3038f5" -dependencies = [ - "proc-macro2", - "quote", - "syn 1.0.109", -] - [[package]] name = "rlp" version = "0.5.2" @@ -5893,38 +5750,18 @@ dependencies = [ "serde", ] -[[package]] -name = "rsa" -version = "0.9.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d" -dependencies = [ - "const-oid 0.9.6", - "digest 0.10.7", - "num-bigint-dig", - "num-integer", - "num-traits", - "pkcs1", - "pkcs8", - "rand_core 0.6.4", - "signature", - "spki", - "subtle", - "zeroize", -] - [[package]] name = "rust_decimal" -version = "1.42.1" +version = "1.43.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "be2a24f50780bc85f09cc6ac299bdf1424302742d77221106859c9d8b102126a" +checksum = "7653272e75dcac41dc199fbea6f5797633994fafd339943c06c9af16bf29cd3a" dependencies = [ "arrayvec", "borsh", "bytes", "num-traits", "rand 0.8.8", - "rkyv", + "rand 0.9.5", "serde", "serde_json", "wasm-bindgen", @@ -5968,11 +5805,11 @@ dependencies = [ [[package]] name = "rustix" -version = "1.1.4" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" +checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "errno", "libc", "linux-raw-sys", @@ -5997,9 +5834,9 @@ dependencies = [ [[package]] name = "rustls-native-certs" -version = "0.8.4" +version = "0.8.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d" +checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4" dependencies = [ "openssl-probe", "rustls-pki-types", @@ -6019,9 +5856,9 @@ dependencies = [ [[package]] name = "rustls-platform-verifier" -version = "0.7.0" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0" +checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98" dependencies = [ "core-foundation 0.10.1", "core-foundation-sys", @@ -6040,9 +5877,9 @@ dependencies = [ [[package]] name = "rustls-platform-verifier-android" -version = "0.1.1" +version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" +checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f" [[package]] name = "rustls-webpki" @@ -6111,9 +5948,9 @@ dependencies = [ [[package]] name = "schannel" -version = "0.1.29" +version = "0.1.30" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939" +checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5" dependencies = [ "windows-sys 0.61.2", ] @@ -6124,12 +5961,6 @@ version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" -[[package]] -name = "seahash" -version = "4.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b" - [[package]] name = "sec1" version = "0.7.3" @@ -6150,7 +5981,7 @@ version = "3.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "core-foundation 0.10.1", "core-foundation-sys", "libc", @@ -6228,14 +6059,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] name = "serde_json" -version = "1.0.151" +version = "1.0.154" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14" +checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6" dependencies = [ "itoa", "memchr", @@ -6296,12 +6127,12 @@ dependencies = [ [[package]] name = "sha2" -version = "0.11.0" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" +checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures 0.3.1", "digest 0.11.3", ] @@ -6380,9 +6211,9 @@ checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa" [[package]] name = "siphasher" -version = "1.0.3" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649" +checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256" [[package]] name = "slab" @@ -6401,9 +6232,9 @@ dependencies = [ [[package]] name = "smallvec" -version = "1.15.2" +version = "1.16.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90" +checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b" [[package]] name = "socket2" @@ -6451,7 +6282,7 @@ version = "0.3.0+sdk-1.3.268.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "eda41003dc44290527a59b13432d4a0379379fa074b70174882adfbdfd917844" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", ] [[package]] @@ -6591,9 +6422,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.4" +version = "3.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f" +checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b" dependencies = [ "proc-macro2", "quote", @@ -6620,13 +6451,24 @@ dependencies = [ "syn 2.0.119", ] +[[package]] +name = "synstructure" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.9", +] + [[package]] name = "sysctl" version = "0.5.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ec7dddc5f0fee506baf8b9fdb989e242f17e4b11c61dfbb0635b705217199eea" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "byteorder", "enum-as-inner", "libc", @@ -6640,7 +6482,7 @@ version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "byteorder", "enum-as-inner", "libc", @@ -6648,12 +6490,6 @@ dependencies = [ "walkdir", ] -[[package]] -name = "tap" -version = "1.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369" - [[package]] name = "tempfile" version = "3.27.0" @@ -6709,11 +6545,11 @@ dependencies = [ [[package]] name = "thiserror" -version = "2.0.20" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f" +checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e" dependencies = [ - "thiserror-impl 2.0.20", + "thiserror-impl 2.0.21", ] [[package]] @@ -6729,13 +6565,13 @@ dependencies = [ [[package]] name = "thiserror-impl" -version = "2.0.20" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" +checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] @@ -6797,9 +6633,9 @@ dependencies = [ [[package]] name = "tinystr" -version = "0.8.4" +version = "0.8.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643" +checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a" dependencies = [ "displaydoc", "zerovec", @@ -6807,18 +6643,9 @@ dependencies = [ [[package]] name = "tinyvec" -version = "1.12.0" +version = "1.13.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f" -dependencies = [ - "tinyvec_macros", -] - -[[package]] -name = "tinyvec_macros" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" +checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" @@ -6844,14 +6671,14 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] name = "tokio-rustls" -version = "0.26.4" +version = "0.26.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" +checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db" dependencies = [ "rustls", "tokio", @@ -6870,9 +6697,9 @@ dependencies = [ [[package]] name = "tokio-util" -version = "0.7.19" +version = "0.7.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52" +checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b" dependencies = [ "bytes", "futures-core", @@ -6884,18 +6711,18 @@ dependencies = [ [[package]] name = "toml_datetime" -version = "1.1.1+spec-1.1.0" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7" +checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053" dependencies = [ "serde_core", ] [[package]] name = "toml_edit" -version = "0.25.13+spec-1.1.0" +version = "0.25.17+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b" +checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c" dependencies = [ "indexmap", "toml_datetime", @@ -6905,9 +6732,9 @@ dependencies = [ [[package]] name = "toml_parser" -version = "1.1.3+spec-1.1.0" +version = "1.1.5+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56" +checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c" dependencies = [ "winnow", ] @@ -6924,7 +6751,7 @@ dependencies = [ "http 1.5.0", "http-body 1.1.0", "http-body-util", - "hyper 1.11.0", + "hyper 1.12.0", "hyper-timeout", "hyper-util", "percent-encoding", @@ -6974,7 +6801,7 @@ version = "0.6.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "bytes", "futures-util", "http 1.5.0", @@ -7131,15 +6958,15 @@ checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94" [[package]] name = "unicode-ident" -version = "1.0.24" +version = "1.0.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" +checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563" [[package]] name = "unicode-normalization" -version = "0.1.25" +version = "0.1.26" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8" +checksum = "75cd3fb03d5288b3ba9a1ee103ac7e9cbb59f0b03d64f8ddfcc04dd42758a85d" dependencies = [ "tinyvec", ] @@ -7221,9 +7048,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" [[package]] name = "uuid" -version = "1.25.0" +version = "1.28.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f053576934f05a761a402421fbbe3d425d9366f75f978806a037b3ca481abecc" +checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606" dependencies = [ "getrandom 0.4.3", "js-sys", @@ -7240,9 +7067,9 @@ checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65" [[package]] name = "value-bag" -version = "1.13.2" +version = "1.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "068e763e8279de7ab94b6afebded2cb701678af094feb1c12ccb061b4783c1be" +checksum = "2799ffb329a792ecfd902b71306c8a815a6ef1c0470fa9953a6aa4d4cecbe511" [[package]] name = "variadics_please" @@ -7282,9 +7109,9 @@ dependencies = [ [[package]] name = "want" -version = "0.3.1" +version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e" +checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b" dependencies = [ "try-lock", ] @@ -7306,9 +7133,9 @@ dependencies = [ [[package]] name = "wasm-bindgen" -version = "0.2.127" +version = "0.2.129" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70" +checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409" dependencies = [ "cfg-if", "once_cell", @@ -7320,19 +7147,20 @@ dependencies = [ [[package]] name = "wasm-bindgen-futures" -version = "0.4.77" +version = "0.4.79" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950" +checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e" dependencies = [ "js-sys", + "tokio", "wasm-bindgen", ] [[package]] name = "wasm-bindgen-macro" -version = "0.2.127" +version = "0.2.129" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1" +checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -7340,31 +7168,31 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.127" +version = "0.2.129" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284" +checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7" dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.9", "wasm-bindgen-shared", ] [[package]] name = "wasm-bindgen-shared" -version = "0.2.127" +version = "0.2.129" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf" +checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6" dependencies = [ "unicode-ident", ] [[package]] name = "wasm-bindgen-test" -version = "0.3.77" +version = "0.3.79" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "895a2607575412a4eda1df892084a375ea10dfeadc4d7d2ab87b854e4ddc7ba1" +checksum = "ae7499dfd45780a0a91d7ee6bb9ac51970a4479a41a89da443fdda5a39547d42" dependencies = [ "async-trait", "cast", @@ -7384,26 +7212,26 @@ dependencies = [ [[package]] name = "wasm-bindgen-test-macro" -version = "0.3.77" +version = "0.3.79" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4288cb0ebe215033bf949ae1fd046726daa4c32a157f24b9dc6ac387a52aa759" +checksum = "3b84b5ac638bfb168196a1a461fcc8f46a294a18b1b6be52133b4e0db122cc9f" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.9", ] [[package]] name = "wasm-bindgen-test-shared" -version = "0.2.127" +version = "0.2.129" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "33ff1c1b360982e93b6d8ea9c04836f71dba0817a16f91e229cf3a51bdd9d987" +checksum = "4f692aa943ccd88363733b77063f32cfed5bc6cbea8e6e8b251b302f881606fe" [[package]] name = "web-sys" -version = "0.3.104" +version = "0.3.106" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30" +checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4" dependencies = [ "js-sys", "wasm-bindgen", @@ -7453,7 +7281,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ec8fb398f119472be4d80bc3647339f56eb63b2a331f6a3d16e25d8144197dd9" dependencies = [ "arrayvec", - "bitflags 2.13.1", + "bitflags 2.13.2", "cfg_aliases", "document-features", "hashbrown 0.15.5", @@ -7483,7 +7311,7 @@ dependencies = [ "arrayvec", "bit-set 0.8.0", "bit-vec 0.8.0", - "bitflags 2.13.1", + "bitflags 2.13.2", "cfg_aliases", "document-features", "hashbrown 0.15.5", @@ -7497,7 +7325,7 @@ dependencies = [ "raw-window-handle", "rustc-hash 1.1.0", "smallvec", - "thiserror 2.0.20", + "thiserror 2.0.21", "wgpu-core-deps-apple", "wgpu-core-deps-emscripten", "wgpu-core-deps-windows-linux-android", @@ -7542,7 +7370,7 @@ dependencies = [ "arrayvec", "ash", "bit-set 0.8.0", - "bitflags 2.13.1", + "bitflags 2.13.2", "block", "bytemuck", "cfg-if", @@ -7571,7 +7399,7 @@ dependencies = [ "raw-window-handle", "renderdoc-sys", "smallvec", - "thiserror 2.0.20", + "thiserror 2.0.21", "wasm-bindgen", "web-sys", "wgpu-types", @@ -7585,11 +7413,11 @@ version = "25.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2aa49460c2a8ee8edba3fca54325540d904dd85b2e086ada762767e17d06e8bc" dependencies = [ - "bitflags 2.13.1", + "bitflags 2.13.2", "bytemuck", "js-sys", "log", - "thiserror 2.0.20", + "thiserror 2.0.21", "web-sys", ] @@ -7982,7 +7810,7 @@ dependencies = [ "futures", "http 1.5.0", "http-body-util", - "hyper 1.11.0", + "hyper 1.12.0", "hyper-util", "log", "once_cell", @@ -8005,15 +7833,6 @@ version = "0.6.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" -[[package]] -name = "wyz" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed" -dependencies = [ - "tap", -] - [[package]] name = "x509-parser" version = "0.18.1" @@ -8027,7 +7846,7 @@ dependencies = [ "nom", "oid-registry", "rusticata-macros", - "thiserror 2.0.20", + "thiserror 2.0.21", "time", ] @@ -8051,12 +7870,12 @@ dependencies = [ [[package]] name = "yoke" -version = "0.8.3" +version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5" +checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3" dependencies = [ "stable_deref_trait", - "yoke-derive 0.8.2", + "yoke-derive 0.8.4", "zerofrom", ] @@ -8069,35 +7888,35 @@ dependencies = [ "proc-macro2", "quote", "syn 2.0.119", - "synstructure", + "synstructure 0.13.2", ] [[package]] name = "yoke-derive" -version = "0.8.2" +version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" +checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", - "synstructure", + "syn 3.0.9", + "synstructure 0.14.0", ] [[package]] name = "zerocopy" -version = "0.8.56" +version = "0.8.63" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb" +checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8" dependencies = [ "zerocopy-derive", ] [[package]] name = "zerocopy-derive" -version = "0.8.56" +version = "0.8.63" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1" +checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f" dependencies = [ "proc-macro2", "quote", @@ -8115,21 +7934,21 @@ dependencies = [ [[package]] name = "zerofrom-derive" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" +checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", - "synstructure", + "syn 3.0.9", + "synstructure 0.14.0", ] [[package]] name = "zeroize" -version = "1.9.0" +version = "1.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e" +checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879" dependencies = [ "zeroize_derive", ] @@ -8152,47 +7971,52 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f" dependencies = [ "displaydoc", - "yoke 0.8.3", + "yoke 0.8.4", "zerofrom", ] [[package]] name = "zerovec" -version = "0.11.8" +version = "0.11.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8" +checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40" dependencies = [ - "yoke 0.8.3", + "yoke 0.8.4", "zerofrom", "zerovec-derive", ] [[package]] name = "zerovec-derive" -version = "0.11.6" +version = "0.11.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" +checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a" dependencies = [ "proc-macro2", "quote", - "syn 3.0.4", + "syn 3.0.9", ] [[package]] name = "zip" -version = "1.1.4" +version = "1.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cc23c04387f4da0374be4533ad1208cbb091d5c11d070dfef13676ad6497164" +checksum = "1b7a5a9285bd4ee13bdeb3f8a4917eb46557e53f270c783849db8bef37b0ad00" dependencies = [ "arbitrary", "crc32fast", "crossbeam-utils", "displaydoc", "indexmap", - "num_enum", "thiserror 1.0.69", ] +[[package]] +name = "zlib-rs" +version = "0.6.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112" + [[package]] name = "zmij" version = "1.0.23" diff --git a/openpay/crates/op-3ds2/Cargo.toml b/openpay/crates/op-3ds2/Cargo.toml index 2c3207896..b23b47cc6 100644 --- a/openpay/crates/op-3ds2/Cargo.toml +++ b/openpay/crates/op-3ds2/Cargo.toml @@ -40,10 +40,12 @@ sha2 = "0.11" # cipher 0.4 generation the rest of the workspace uses (aes 0.8 / cbc 0.1), # so the build keeps a single aes + cipher in the graph. -# RSA for legacy issuer ACS public keys, P-256 for the modern -# ECDH-based session key establishment used by the SDK device-binding -# flow. -rsa = "0.9" +# P-256 for the ECDH-based session key establishment used by the SDK +# device-binding flow. There is deliberately no RSA here: the legacy +# issuer-ACS public-key path was never implemented, and the `rsa` crate it +# would have used carries RUSTSEC-2023-0071 (Marvin timing sidechannel) with +# no fixed version available. Reintroducing it needs a constant-time +# implementation, not a version bump. p256 = { version = "0.13", features = ["ecdh", "ecdsa"] } # X.509 parsing for DS / ACS certificate chain validation. Each card -- 2.54.0 (Apple Git-157) From 4d7edf3b36373c36d30cdb4bf6c2926927277541 Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Thu, 22 Oct 2026 12:45:52 -0400 Subject: [PATCH 4/5] trx, screening: resolve XML entity references, which quick-xml 0.41 now reports as their own event MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The quick-xml 0.41 bump did not just rename `BytesText::unescape`. 0.41 reports every entity reference — `&`, `'`, `&` — as its own `Event::GeneralRef` instead of folding it into the surrounding text. Both XML readers here matched only `Event::Text`, so after the bump each reference was dropped **silently**: the document still parsed, every existing test still passed, and the values were wrong. That is the dangerous shape of this change, and it is why it needed more than a compile fix: - `op-screening` parses the OFAC/EU/UN sanctions lists. An entry published as "Smith & Co" was being stored as "Smith Co" — a name that no longer matches the party it names, with nothing downstream able to tell. A screening miss reads exactly like a clean screen. - `jouleclaw-transform-trx` carries JSON property values through TRX XML. The quotes arrive escaped, so dropping the references turned `{"k":1}` into `{k:1}`, which fails to parse and falls back to being stored as a bare string. One round-trip test caught this; nothing else did. Both readers now accumulate an element's character data across events and resolve each reference: a numeric reference through `resolve_char_ref`, a named one through `resolve_predefined_entity`. TRX carries no DTD, so an unknown name there is refused rather than dropped. The sanctions readers keep an unknown reference in its literal `&name;` form, so the anomaly stays visible in the record instead of silently altering a name. `trim_text(true)` had to go with it, on all four readers. Trimming is applied per text event, so once a run is split by a reference the trim eats the spaces on either side of it — "Smith & Co" became "Smith&Co", which the new tests caught. The assembled value is trimmed once where it is consumed instead; the screening readers already did exactly that at every consumer, making the reader-level trim redundant there even before this change. Tests: the fixtures had no entity in them anywhere, which is precisely why a silent data-corruption bug could pass CI. Added, failing first: a sanctioned name carrying `&` and one carrying `&` (different code paths — a named predefine and a numeric reference), entity references in TRX text asserted against hand-written XML rather than our own writer's escaping, and a refusal for an unresolvable name. Co-Authored-By: Claude Opus 5 --- .../crates/jouleclaw-transform-trx/src/lib.rs | 130 +++++++++++++++--- openpay/crates/op-screening/src/updater.rs | 105 +++++++++++++- 2 files changed, 211 insertions(+), 24 deletions(-) diff --git a/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs b/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs index c8966cef2..d25c776d3 100644 --- a/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs +++ b/jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs @@ -176,7 +176,11 @@ pub fn parse_response(xml: &str) -> Result { use quick_xml::Reader; let mut reader = Reader::from_str(xml); - reader.config_mut().trim_text(true); + // Deliberately no `trim_text(true)`: quick-xml reports an entity reference as + // its own event, so one element's text arrives in several pieces and a + // per-piece trim eats the spaces around the entity. The assembled value is + // trimmed once, where it is consumed. + reader.config_mut().trim_text(false); let mut buf = Vec::new(); let mut entities: Vec = Vec::new(); @@ -193,6 +197,13 @@ pub fn parse_response(xml: &str) -> Result { // Per-UIMessage scratch. let mut cur_uimsg_kind: Option = None; + // Character data for the element currently open. quick-xml 0.41 reports an + // entity reference as its own `GeneralRef` event rather than folding it into + // the surrounding text, so one element's content can arrive as several + // events. Accumulating here and consuming it at the matching End is what + // keeps `a & b` from arriving as just `b`. + let mut chars = String::new(); + let mut in_value = false; let mut in_weight = false; let mut in_field = false; @@ -217,10 +228,17 @@ pub fn parse_response(xml: &str) -> Result { } } } - "Value" => in_value = true, - "Weight" => in_weight = true, + "Value" => { + in_value = true; + chars.clear(); + } + "Weight" => { + in_weight = true; + chars.clear(); + } "Field" => { in_field = true; + chars.clear(); for attr in e.attributes().with_checks(false).flatten() { if attr.key.as_ref() == b"Name" { let v = attr @@ -232,6 +250,7 @@ pub fn parse_response(xml: &str) -> Result { } "UIMessage" => { in_uimsg = true; + chars.clear(); let mut kind = UiMessageKind::Inform; for attr in e.attributes().with_checks(false).flatten() { if attr.key.as_ref() == b"Type" { @@ -253,29 +272,58 @@ pub fn parse_response(xml: &str) -> Result { } } Ok(Event::Text(t)) => { - let text = t - .unescape() - .map_err(|err| TrxError::Decode(format!("text: {err}")))? - .to_string(); - if in_value { - cur_entity_value = Some(text); - } else if in_weight { - cur_entity_weight = text.parse::().ok(); - } else if in_field { - cur_field_value = Some(text); - } else if in_uimsg - && let Some(kind) = cur_uimsg_kind.take() { - messages.push(UiMessage { kind, text }); + // Text now holds no entity reference: 0.41 delivers each one as a + // GeneralRef event below. `xml10_content` decodes the bytes and + // normalizes end-of-line runs; there is nothing left to unescape. + chars.push_str( + &t.xml10_content() + .map_err(|err| TrxError::Decode(format!("text: {err}")))?, + ); + } + Ok(Event::GeneralRef(r)) => { + // `&` and `&` both land here. Resolving them is not + // optional: a parser that ignores this event drops the character + // silently, and a property value that should read `{"a":1}` comes + // back as the bare string `{a:1}` — well-formed, wrong, and quiet. + if let Some(ch) = r + .resolve_char_ref() + .map_err(|err| TrxError::Decode(format!("char ref: {err}")))? + { + chars.push(ch); + } else { + let name = r + .decode() + .map_err(|err| TrxError::Decode(format!("entity name: {err}")))?; + match quick_xml::escape::resolve_predefined_entity(&name) { + Some(text) => chars.push_str(text), + // TRX carries no DTD, so there is no legitimate entity + // beyond the five XML predefines. Refuse rather than drop. + None => { + return Err(TrxError::Decode(format!( + "unknown entity reference '&{name};'" + ))) + } } + } } Ok(Event::End(ref e)) => { let name = std::str::from_utf8(e.name().as_ref()) .map_err(|err| TrxError::Decode(format!("utf8: {err}")))? .to_string(); match name.as_str() { - "Value" => in_value = false, - "Weight" => in_weight = false, + "Value" => { + in_value = false; + cur_entity_value = Some(chars.trim().to_string()); + chars.clear(); + } + "Weight" => { + in_weight = false; + cur_entity_weight = chars.trim().parse::().ok(); + chars.clear(); + } "Field" => { + cur_field_value = Some(chars.trim().to_string()); + chars.clear(); if let (Some(n), Some(v)) = (cur_field_name.take(), cur_field_value.take()) { @@ -287,7 +335,13 @@ pub fn parse_response(xml: &str) -> Result { } "UIMessage" => { in_uimsg = false; - cur_uimsg_kind = None; + if let Some(kind) = cur_uimsg_kind.take() { + messages.push(UiMessage { + kind, + text: chars.trim().to_string(), + }); + chars.clear(); + } } "Entity" => { let ty = cur_entity_type @@ -528,6 +582,44 @@ mod tests { assert!(LOSSY_FIELDS_ON_TRX_ROUND_TRIP.contains(&"activity")); } + /// Entity references in element text must reach the parsed value. + /// + /// quick-xml delivers each `&` / `&` as its own event, so one + /// element's content arrives as several events and a parser that reads only + /// the text events keeps the last fragment and discards the rest. This + /// asserts on XML written by hand rather than by `render_response`, so it + /// still holds if the writer's escaping ever changes. + #[test] + fn entity_references_in_text_reach_the_parsed_value() { + let xml = concat!( + "", + r#""#, + "a & b & c <z>", + r#"x 'q' y"#, + "", + ); + let parsed = parse_response(xml).unwrap(); + assert_eq!(parsed.entities[0].value, "a & b & c "); + assert_eq!( + parsed.entities[0].properties.get("n").unwrap(), + &serde_json::json!("x 'q' y") + ); + } + + /// An entity name that is not one of the five XML predefines is refused. + /// + /// TRX carries no DTD, so `&oops;` cannot be resolved. Dropping it would + /// silently change the value; this asserts the parse fails instead. + #[test] + fn an_unknown_entity_reference_is_refused() { + let xml = concat!( + "", + r#"a &oops; b"#, + "", + ); + assert!(parse_response(xml).is_err()); + } + #[test] fn complex_property_value_round_trips_as_json_object() { let e = Entity::new("e1", "test.X", "v") diff --git a/openpay/crates/op-screening/src/updater.rs b/openpay/crates/op-screening/src/updater.rs index 9e7adb06c..c47286951 100644 --- a/openpay/crates/op-screening/src/updater.rs +++ b/openpay/crates/op-screening/src/updater.rs @@ -57,6 +57,34 @@ pub struct OfacUpdater { pub client: reqwest::Client, } + +/// Append a resolved XML entity reference to `out`. +/// +/// quick-xml 0.41 delivers `&name;` and `&#nn;` as `Event::GeneralRef` rather +/// than inside the adjacent text, so each one has to be resolved by hand. An +/// unknown name is appended in its original `&name;` form rather than dropped: +/// these feeds carry no DTD, so an unrecognised entity means the input is not +/// what we think it is, and losing the characters silently would quietly alter +/// a sanctioned name. Keeping the literal text makes the anomaly visible to +/// whoever reads the record. +fn push_entity_ref(r: &quick_xml::events::BytesRef<'_>, out: &mut String) { + match r.resolve_char_ref() { + Ok(Some(ch)) => out.push(ch), + Ok(None) => { + let name = r.decode().unwrap_or_default(); + match quick_xml::escape::resolve_predefined_entity(&name) { + Some(text) => out.push_str(text), + None => { + out.push('&'); + out.push_str(&name); + out.push(';'); + } + } + } + Err(_) => {} + } +} + impl Default for OfacUpdater { fn default() -> Self { Self { @@ -95,7 +123,13 @@ impl OfacUpdater { /// ``` pub fn parse_sdn_xml(xml: &str) -> Result> { let mut reader = Reader::from_str(xml); - reader.config_mut().trim_text(true); + // Deliberately no `trim_text(true)`: quick-xml reports an entity + // reference as its own event, so one element's text arrives in several + // pieces and a per-piece trim eats the spaces around the entity — + // "Smith & Co" becomes "Smith&Co". Every consumer below trims the + // assembled value instead, which is the same result for whitespace and + // the correct one for entities. + reader.config_mut().trim_text(false); let mut entities = Vec::new(); let mut buf = Vec::new(); @@ -116,7 +150,16 @@ impl OfacUpdater { text_buf.clear(); } Ok(Event::Text(e)) => { - text_buf.push_str(&e.unescape().unwrap_or_default()); + text_buf.push_str(&e.xml10_content().unwrap_or_default()); + } + Ok(Event::GeneralRef(r)) => { + // quick-xml 0.41 reports every `&` / `&` as its own + // event instead of folding it into the surrounding text, so a + // loop that matches only Event::Text drops it silently. That is + // not cosmetic on this list: an OFAC entry recorded as + // "Smith Co" instead of "Smith & Co" is a screening miss, and + // nothing downstream can tell the difference. + push_entity_ref(&r, &mut text_buf); } Ok(Event::End(e)) => { let name = String::from_utf8_lossy(e.name().as_ref()).to_string(); @@ -291,7 +334,13 @@ impl EuUpdater { /// distinguish persons from entities. pub fn parse_eu_xml(xml: &str) -> Result> { let mut reader = Reader::from_str(xml); - reader.config_mut().trim_text(true); + // Deliberately no `trim_text(true)`: quick-xml reports an entity + // reference as its own event, so one element's text arrives in several + // pieces and a per-piece trim eats the spaces around the entity — + // "Smith & Co" becomes "Smith&Co". Every consumer below trims the + // assembled value instead, which is the same result for whitespace and + // the correct one for entities. + reader.config_mut().trim_text(false); let mut entities = Vec::new(); let mut buf = Vec::new(); @@ -475,7 +524,13 @@ impl UnUpdater { /// ``` pub fn parse_un_xml(xml: &str) -> Result> { let mut reader = Reader::from_str(xml); - reader.config_mut().trim_text(true); + // Deliberately no `trim_text(true)`: quick-xml reports an entity + // reference as its own event, so one element's text arrives in several + // pieces and a per-piece trim eats the spaces around the entity — + // "Smith & Co" becomes "Smith&Co". Every consumer below trims the + // assembled value instead, which is the same result for whitespace and + // the correct one for entities. + reader.config_mut().trim_text(false); let mut entities = Vec::new(); let mut buf = Vec::new(); @@ -503,7 +558,16 @@ impl UnUpdater { text_buf.clear(); } Ok(Event::Text(e)) => { - text_buf.push_str(&e.unescape().unwrap_or_default()); + text_buf.push_str(&e.xml10_content().unwrap_or_default()); + } + Ok(Event::GeneralRef(r)) => { + // quick-xml 0.41 reports every `&` / `&` as its own + // event instead of folding it into the surrounding text, so a + // loop that matches only Event::Text drops it silently. That is + // not cosmetic on this list: an OFAC entry recorded as + // "Smith Co" instead of "Smith & Co" is a screening miss, and + // nothing downstream can tell the difference. + push_entity_ref(&r, &mut text_buf); } Ok(Event::End(e)) => { let name = String::from_utf8_lossy(e.name().as_ref()).to_string(); @@ -800,6 +864,37 @@ mod tests { assert_eq!(parsed[1].source_list, WatchList::OfacSdn); } + /// An entity reference inside a sanctioned name must survive the parse. + /// + /// quick-xml reports `&` and `&` as events of their own, so a reader + /// that handles only text drops them without erroring. The name still parses, + /// still looks plausible, and no longer matches the party it names — the + /// failure mode a screening list cannot afford. Both spellings are checked + /// because they travel different code paths: a named predefine and a + /// numeric character reference. + #[test] + fn an_entity_reference_in_a_name_survives_the_sdn_parse() { + let xml = r#" + + + 9999 + Smith & Co + Entity + SDGT + + + 10000 + Jones & Partners + Entity + SDGT + +"#; + let parsed = OfacUpdater::parse_sdn_xml(xml).expect("parse"); + assert_eq!(parsed.len(), 2); + assert_eq!(parsed[0].name, "Smith & Co"); + assert_eq!(parsed[1].name, "Jones & Partners"); + } + #[test] fn parse_minimal_un() { let xml = r#" -- 2.54.0 (Apple Git-157) From 4e7fa646ed032381a8bd63dbbefcec49cde516fa Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Thu, 22 Oct 2026 12:49:04 -0400 Subject: [PATCH 5/5] ci: gate on cargo-audit, so an advisory has to be read rather than accumulated MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 142 vulnerability instances this branch started from were not the result of a decision. They accumulated because a vulnerable crate usually arrives transitively, in a lockfile nobody edited, and nothing in CI was looking. The fixes in this branch are worth little if the backlog can rebuild quietly. `scripts/check-advisories.py` runs `cargo audit --json` over every tracked Cargo.lock and fails on any advisory not named in its ALLOW table. It reads the advisory database and the lockfiles; it builds nothing. ALLOW is the substance. An advisory may be left in place — upstream has no fixed release, the vulnerable call is unreachable, it is dev-only — but only in writing, with the reason beside the id. Two rules keep that from rotting: - an unlisted advisory fails, so a new one gets looked at; - a listed advisory that no longer appears anywhere ALSO fails, so an excuse cannot outlive the exposure it was written for. An allow list that is never pruned stops describing the tree and starts hiding it. It currently allows 18, each with its reason: zip and rsa as unreachable, hpke-rs 0.2.0 as dev-only, and quick-xml/libcrux-kem/h2/hickory-proto/pyo3 as pinned by dependents that need an upstream release. The quick-xml 0.37.5 entry is marked as a known remaining exposure on the ISO 20022 ingestion path rather than a dismissal, so it reads as debt and not as a verdict. Warnings (unmaintained, unsound, yanked — 67 of them) are counted and printed but do not fail the run: gating on maintenance advice would bury the reachable defects in noise. Printing the count keeps the number visible instead of unknown. A lockfile that cannot be audited at all fails under its own heading, so an error is never read as "clean" — the same failure-closed shape as check-lockfiles.sh, and the mistake this sweep made by hand when a broken output parser reported "0 vulnerabilities" while criticals were printing. The self-test asserts the check passes a reviewed tree and fails each way it should: an unlisted advisory, an allowance matching nothing, and a document that does not parse. Co-Authored-By: Claude Opus 5 --- .github/workflows/repo-checks.yml | 16 +- scripts/check-advisories-selftest.sh | 81 ++++++++++ scripts/check-advisories.py | 228 +++++++++++++++++++++++++++ 3 files changed, 324 insertions(+), 1 deletion(-) create mode 100755 scripts/check-advisories-selftest.sh create mode 100755 scripts/check-advisories.py diff --git a/.github/workflows/repo-checks.yml b/.github/workflows/repo-checks.yml index 1f2428230..c1a71cd09 100644 --- a/.github/workflows/repo-checks.yml +++ b/.github/workflows/repo-checks.yml @@ -25,7 +25,7 @@ concurrency: jobs: checks: - name: lockfiles, tests in CI, workflow hygiene, spec and section references, public text + name: lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text runs-on: linux-arm64 timeout-minutes: 30 steps: @@ -54,6 +54,20 @@ jobs: if: ${{ !cancelled() }} run: ./scripts/check-lockfiles.sh + # ── No workspace carries an advisory nobody has read ───────────────────── + # cargo-audit reads the lockfile and the advisory database; it builds + # nothing. The runner is persistent, so this installs once. + - name: Install cargo-audit + if: ${{ !cancelled() }} + shell: bash + run: command -v cargo-audit >/dev/null || cargo install cargo-audit --locked + - name: "advisories: the check fails closed (self-test)" + if: ${{ !cancelled() }} + run: ./scripts/check-advisories-selftest.sh + - name: "advisories: every advisory is fixed or allowed with a reason" + if: ${{ !cancelled() }} + run: python3 -I scripts/check-advisories.py + # ── Every test file is run by a job or listed with its reason ──────────── - name: "tests in CI: the check fails closed (self-test)" if: ${{ !cancelled() }} diff --git a/scripts/check-advisories-selftest.sh b/scripts/check-advisories-selftest.sh new file mode 100755 index 000000000..c6f0faeb9 --- /dev/null +++ b/scripts/check-advisories-selftest.sh @@ -0,0 +1,81 @@ +#!/usr/bin/env bash +# +# check-advisories-selftest.sh — check-advisories.py can fail. +# +# A check that cannot fail is decoration. This feeds the check pre-captured +# `cargo audit --json` documents through `--from-json` and asserts that it +# 1. passes when every advisory found is allowed and every allowed advisory +# is found; +# 2. fails when an advisory is reported that the allow list does not name +# (the case this check exists for); +# 3. fails when an allow-list entry matches nothing, so an excuse cannot +# outlive the exposure it was written for; +# 4. fails, and says it could not audit, when the document does not parse: +# an error is never read as "clean". +# +# Nothing here runs cargo or reads the advisory database, so it needs no +# network and no lockfile. +set -uo pipefail + +here=$(cd "$(dirname "$0")" && pwd) +check="$here/check-advisories.py" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT + +# Every advisory the check allows, read from the check itself so the two cannot +# drift apart. +# (a read loop, not `mapfile`: macOS ships bash 3.2, where mapfile does not exist) +allowed=() +while IFS= read -r id; do allowed+=("$id"); done < <( + grep -oE '^ "RUSTSEC-[0-9]{4}-[0-9]{4}"' "$check" | tr -d ' "' +) +if [ ${#allowed[@]} -eq 0 ]; then + echo "selftest: could not read the allow list out of $check" >&2 + exit 2 +fi + +# write_json ... — a cargo-audit document reporting exactly these. +write_json() { + local out=$1; shift + { printf '{"vulnerabilities":{"found":true,"count":%d,"list":[' "$#" + local first=1 id + for id in "$@"; do + [ $first -eq 1 ] || printf ',' + first=0 + printf '{"advisory":{"id":"%s","title":"t"},"package":{"name":"c","version":"1.0.0"}}' "$id" + done + printf ']},"warnings":{}}' + } > "$out" +} + +fails=0 +expect() { # expect [text the output must hold] -- + local want=$1 what=$2 needle=$3; shift 3; [ "${1:-}" = -- ] && shift + local out rc + out=$(python3 -I "$check" --from-json "$@" 2>&1); rc=$? + if [ "$want" = pass ] && [ $rc -ne 0 ]; then + echo "FAIL $what: the check failed"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return + fi + if [ "$want" = fail ] && [ $rc -eq 0 ]; then + echo "FAIL $what: the check passed"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return + fi + if [ -n "$needle" ] && ! grep -q -- "$needle" <<<"$out"; then + echo "FAIL $what: the output does not say '$needle'"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return + fi + echo "ok $what" +} + +write_json "$tmp/all.json" "${allowed[@]}" +expect pass "every advisory allowed and every allowance used passes" "" -- "$tmp/all.json" + +write_json "$tmp/extra.json" "${allowed[@]}" "RUSTSEC-2099-0001" +expect fail "an advisory the allow list does not name fails" "not in the allow list" -- "$tmp/extra.json" + +write_json "$tmp/short.json" "${allowed[@]:1}" +expect fail "an allowance that matches nothing fails" "no longer match anything" -- "$tmp/short.json" + +printf 'this is not json\n' > "$tmp/broken.json" +expect fail "a document that does not parse fails as unaudited, not as clean" "Could not be audited" -- "$tmp/broken.json" + +if [ $fails -ne 0 ]; then echo "check-advisories-selftest: $fails failure(s)"; exit 1; fi +echo "check-advisories-selftest: the check passes a reviewed tree and fails each way it should." diff --git a/scripts/check-advisories.py b/scripts/check-advisories.py new file mode 100755 index 000000000..d113cb19d --- /dev/null +++ b/scripts/check-advisories.py @@ -0,0 +1,228 @@ +#!/usr/bin/env python3 +# +# check-advisories.py — no workspace carries a security advisory nobody has read. +# +# This tree holds many workspaces, and a vulnerable crate usually arrives +# transitively, in a lockfile nobody edited, for a reason nobody chose. Without +# a gate the backlog only grows, and it grew: a sweep in October 2026 found 142 +# vulnerability instances across 47 lockfiles, among them a WASM runtime with a +# filesystem sandbox escape in the one component whose job is confinement. +# Nothing had failed, because nothing was looking. +# +# For every tracked Cargo.lock this runs +# +# cargo audit --file --json +# +# and fails on any advisory that is not in ALLOW below. It reads the advisory +# database and the lockfile; it builds nothing. +# +# ALLOW is the whole point. An advisory may be left in place — upstream has no +# fixed release, or the vulnerable call is unreachable here — but only in +# writing, with the reason next to the id. Two rules keep that honest: +# +# * an advisory that is not listed fails the run, so a new one has to be +# looked at rather than accumulated; +# * a listed advisory that no longer appears anywhere ALSO fails the run, so +# an entry cannot outlive the exposure it excused. An allow list that is +# never pruned stops describing the tree and starts hiding it. +# +# Warnings (unmaintained, unsound, yanked) are counted and printed but do not +# fail the run: they are advice about maintenance, not a reachable defect, and +# gating on them would bury the vulnerabilities in noise. They are printed so +# the number stays visible rather than unknown. +# +# check-advisories.py every tracked Cargo.lock, less SKIP +# check-advisories.py DIR ... exactly these directories +# check-advisories.py --from-json F... audit JSON already captured (self-test) +# +# Exit 0: every advisory found is allowed, and every allowed advisory was found. +# Exit 1: otherwise — including when a lockfile could not be audited at all, +# which is reported under its own heading so an error is never read as "clean". +import json +import os +import subprocess +import sys + +# Advisories left in place on purpose. Each needs the reason, and each must +# still be reported by at least one lockfile or this check fails. +ALLOW = { + # ── Unreachable here ──────────────────────────────────────────────────── + # All three are faults in `extract()`: SUID/SGID bits preserved from the + # archive, symlinks whose targets escape the destination, and permissions + # applied through those symlinks. Nothing in this tree extracts an archive + # — there is no `ZipArchive` or `ZipStreamReader` call site. zip arrives + # under candle-core and the wasm toolchain. + "RUSTSEC-2026-0367": "zip: extract-only; nothing here extracts an archive", + "RUSTSEC-2026-0368": "zip: extract-only; nothing here extracts an archive", + "RUSTSEC-2026-0369": "zip: extract-only; nothing here extracts an archive", + "RUSTSEC-2025-0168": "zip: extract-only path canonicalization; nothing here extracts", + # The Marvin attack recovers an RSA key from the timing of private-key + # decryption. There is no fixed release of `rsa` at all. It reaches + # sandbox-rs and wai-rs transitively and neither holds an RSA private key + # nor decrypts: openpay's unused direct dependency was removed outright. + "RUSTSEC-2023-0071": "rsa: no fixed release; no private-key decryption here", + # ── Not in a shipped artifact ────────────────────────────────────────── + # The production MLS path (joule-moq-mls) resolves the patched hpke-rs + # 0.7.0. These four are the old 0.2.0, reached only through a + # [dev-dependencies] edge of joule-code-collab, which still pins the + # openmls 0.6/0.3 stack. Test graph only; aligning it to the 0.9.1/0.6.0 + # stack already used in-repo would remove them. + "RUSTSEC-2026-0069": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0", + "RUSTSEC-2026-0070": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0", + "RUSTSEC-2026-0071": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0", + "RUSTSEC-2026-0072": "hpke-rs-rust-crypto 0.2.0: dev-dependency only", + # ── Pinned by a dependency; needs an upstream release ────────────────── + # hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are + # panics on short or malformed hybrid keys — denial of service, not memory + # corruption. Fixed by an openmls/hpke-rs release, not from here. + "RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream", + "RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream", + # quick-xml is 0.41 everywhere the version is ours to choose. openpay also + # resolves 0.37.5 through open-payments-iso20022 1.0.10 (no later release + # exists), and smart-byte resolves 0.39.4 through plist -> netdev -> + # netwatch -> iroh. NOTE: the openpay path is the same ISO 20022 surface we + # harden directly, so this entry is a known remaining exposure on a payment + # ingestion path, not a dismissal. Drop it the moment upstream ships. + "RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: pinned by open-payments-iso20022 and iroh", + "RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused here; dependents pin the version", + # h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive; + # the fix is a major move for the dependent. + "RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent", + # hickory-proto 0.25.2 under smart-byte via iroh. -0118 has no fixed + # release; -0119 needs 0.26, which iroh does not take yet. + "RUSTSEC-2026-0118": "hickory-proto: no fixed release; transitive under iroh", + "RUSTSEC-2026-0119": "hickory-proto: 0.26 not taken by iroh yet", + # pyo3 0.28.3 under eoc-rs. Both need 0.29, a breaking move for the binding. + "RUSTSEC-2026-0176": "pyo3: 0.29 is a breaking move for the binding", + "RUSTSEC-2026-0177": "pyo3: 0.29 is a breaking move for the binding", +} + +# Lockfiles cargo does not read: a vendored crate's own lock, kept with the +# vendored source. Each must still exist, or the entry is stale. +SKIP = ( + "jouledesk/jouledesk-rs/vendor/libwebrtc", + "joule-code/joule-code-rs/vendor/wtransport", +) + + +def discover(): + root = subprocess.run( + ["git", "rev-parse", "--show-toplevel"], capture_output=True, text=True + ).stdout.strip() + if not root: + sys.exit("check-advisories: not in a git checkout.") + os.chdir(root) + for d in SKIP: + if not os.path.isfile(os.path.join(d, "Cargo.lock")): + sys.exit( + f"check-advisories: the skip list names {d}, which holds no " + "Cargo.lock. Remove the entry." + ) + out = subprocess.run(["git", "ls-files"], capture_output=True, text=True).stdout + locks = [ + p + for p in out.splitlines() + if p == "Cargo.lock" or p.endswith("/Cargo.lock") + if os.path.dirname(p) not in SKIP + ] + return sorted(locks) + + +def audit(lock): + """Return (parsed_json, error_text). Exactly one is None.""" + try: + p = subprocess.run( + ["cargo", "audit", "--file", lock, "--json", "--color", "never"], + capture_output=True, + text=True, + timeout=600, + ) + except FileNotFoundError: + return None, "cargo is not on PATH" + except subprocess.TimeoutExpired: + return None, "cargo audit timed out" + # cargo audit exits non-zero when it finds something, so the exit status is + # not the signal; absence of parseable JSON is. + try: + return json.loads(p.stdout), None + except json.JSONDecodeError: + tail = (p.stderr or p.stdout or "").strip().splitlines() + return None, "; ".join(tail[-3:]) or "no JSON on stdout" + + +def main(): + args = sys.argv[1:] + from_json = False + if args and args[0] == "--from-json": + from_json, args = True, args[1:] + + if from_json: + sources = [(f, None) for f in args] + elif args: + sources = [(os.path.join(d, "Cargo.lock"), None) for d in args] + else: + sources = [(l, None) for l in discover()] + if not sources: + sys.exit("check-advisories: found no Cargo.lock to check.") + + found = {} # id -> [(crate, version, lock)] + unchecked = [] # (lock, why) + warn_count = 0 + + for lock, _ in sources: + if from_json: + try: + with open(lock) as fh: + data, err = json.load(fh), None + except Exception as e: # noqa: BLE001 + data, err = None, str(e) + else: + data, err = audit(lock) + if data is None: + unchecked.append((lock, err)) + continue + for v in (data.get("vulnerabilities") or {}).get("list") or []: + adv, pkg = v.get("advisory") or {}, v.get("package") or {} + found.setdefault(adv.get("id", "?"), []).append( + (pkg.get("name", "?"), pkg.get("version", "?"), lock) + ) + for kind, items in (data.get("warnings") or {}).items(): + warn_count += len(items or []) + + unexpected = {k: v for k, v in found.items() if k not in ALLOW} + stale = [k for k in ALLOW if k not in found] + + if unexpected: + print("Advisories that are not in the allow list:\n") + for adv in sorted(unexpected): + for crate, ver, lock in unexpected[adv]: + print(f" {adv} {crate} {ver}") + print(f" {lock}") + print( + "\nFix each, or add it to ALLOW in scripts/check-advisories.py with the\n" + "reason it can be left — unreachable, dev-only, or pinned upstream." + ) + if stale: + print("\nAllow-list entries that no longer match anything:\n") + for adv in sorted(stale): + print(f" {adv} — {ALLOW[adv]}") + print( + "\nThe exposure is gone. Remove the entry, so the list keeps describing\n" + "the tree instead of hiding it." + ) + if unchecked: + print("\nCould not be audited (this is not a verdict on the lockfile):\n") + for lock, why in unchecked: + print(f" {lock}: {why}") + + if unexpected or stale or unchecked: + return 1 + print( + f"check-advisories: {len(sources)} lockfiles, " + f"{len(found)} allowed advisories, {warn_count} warnings (not gated)." + ) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) -- 2.54.0 (Apple Git-157)