Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions 1

sec: close the cargo-audit backlog — move the WASM sandbox off a runtime with a filesystem escape, an aarch64 miscompile and a fuel-limit bypass #443

Merged
dcharlot merged 5 commits from sec/advisory-sweep-2026-10 into main 2026-10-22 12:49:07 -04:00
Conversation 0 Commits 5 Files changed 35 +1302 -1055
35 changed files with 1302 additions and 1055 deletions
Download patch file Download diff file Expand all files Collapse all files

16
.github/workflows/repo-checks.yml vendored
View file

@ -25,7 +25,7 @@ concurrency:
jobs:
checks:
name: lockfiles, tests in CI, workflow hygiene, spec and section references, public text
name: lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text
runs-on: linux-arm64
timeout-minutes: 30
steps:
@ -54,6 +54,20 @@ jobs:
if: ${{ !cancelled() }}
run: ./scripts/check-lockfiles.sh
# ── No workspace carries an advisory nobody has read ─────────────────────
# cargo-audit reads the lockfile and the advisory database; it builds
# nothing. The runner is persistent, so this installs once.
- name: Install cargo-audit
if: ${{ !cancelled() }}
shell: bash
run: command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
- name: "advisories: the check fails closed (self-test)"
if: ${{ !cancelled() }}
run: ./scripts/check-advisories-selftest.sh
- name: "advisories: every advisory is fixed or allowed with a reason"
if: ${{ !cancelled() }}
run: python3 -I scripts/check-advisories.py
# ── Every test file is run by a job or listed with its reason ────────────
- name: "tests in CI: the check fails closed (self-test)"
if: ${{ !cancelled() }}

4
aac/aac-rs/Cargo.lock generated
View file

@ -2453,9 +2453,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",

4
eoc/eoc-bench/Cargo.lock generated
View file

@ -496,9 +496,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"pin-project-lite",
"tokio-macros",

32
eoc/eoc-rs/Cargo.lock generated
View file

@ -1134,7 +1134,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2660,9 +2660,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.17"
version = "0.11.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
dependencies = [
"aws-lc-rs",
"bytes",
@ -2692,7 +2692,7 @@ dependencies = [
"once_cell",
"socket2",
"tracing",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2989,14 +2989,14 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"aws-lc-rs",
"once_cell",
@ -3046,7 +3046,7 @@ dependencies = [
"security-framework",
"security-framework-sys",
"webpki-root-certs",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3057,9 +3057,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@ -3466,7 +3466,7 @@ dependencies = [
"getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3569,9 +3569,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -3988,9 +3988,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@ -4011,7 +4011,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]

4
joule-code/examples/l3-jouleclaw/Cargo.lock generated
View file

@ -666,9 +666,9 @@ dependencies = [
[[package]]
name = "quick-xml"
version = "0.36.2"
version = "0.41.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe"
checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
dependencies = [
"memchr",
]

4
joule-code/examples/transport-moqt/Cargo.lock generated
View file

@ -1041,9 +1041,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",

28
joule-code/joule-code-rs/Cargo.lock generated
View file

@ -926,7 +926,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3138,9 +3138,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.17"
version = "0.11.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
dependencies = [
"bytes",
"fastbloom",
@ -3171,7 +3171,7 @@ dependencies = [
"once_cell",
"socket2",
"tracing",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3404,9 +3404,9 @@ dependencies = [
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"aws-lc-rs",
"log",
@ -3458,7 +3458,7 @@ dependencies = [
"security-framework",
"security-framework-sys",
"webpki-root-certs",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3469,9 +3469,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@ -4113,9 +4113,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -4469,9 +4469,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@ -4482,7 +4482,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]

38
joule-code/joule-code-rs/crates/joule-moq-room/Cargo.lock generated
View file

@ -470,9 +470,9 @@ dependencies = [
[[package]]
name = "crossbeam-epoch"
version = "0.9.21"
version = "0.9.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
dependencies = [
"crossbeam-utils",
]
@ -744,7 +744,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2334,9 +2334,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.17"
version = "0.11.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
dependencies = [
"bytes",
"fastbloom",
@ -2367,7 +2367,7 @@ dependencies = [
"once_cell",
"socket2",
"tracing",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2595,14 +2595,14 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"once_cell",
"ring",
@ -2652,7 +2652,7 @@ dependencies = [
"security-framework",
"security-framework-sys",
"webpki-root-certs",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2663,9 +2663,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"ring",
"rustls-pki-types",
@ -3057,10 +3057,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
"getrandom 0.4.3",
"getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3172,9 +3172,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -3515,9 +3515,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@ -3528,7 +3528,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]

30
jouleclaw/jouleclaw-rs/Cargo.lock generated
View file

@ -6258,9 +6258,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
[[package]]
name = "quick-xml"
version = "0.36.2"
version = "0.41.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe"
checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
dependencies = [
"memchr",
]
@ -6287,9 +6287,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.17"
version = "0.11.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
dependencies = [
"aws-lc-rs",
"bytes",
@ -6843,9 +6843,9 @@ dependencies = [
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"aws-lc-rs",
"log",
@ -6917,9 +6917,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@ -7655,9 +7655,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -8265,9 +8265,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@ -8278,14 +8278,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.9",
"webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]

2
jouleclaw/jouleclaw-rs/Cargo.toml
View file

@ -1174,7 +1174,7 @@ base64 = "0.22"
# Wave-7 — close-the-gaps deps
ciborium = "0.2" # CBOR for EAT-CWT + CoRIM (IETF RATS WG canonical CBOR codec)
ed25519-dalek = "2" # Ed25519 signing — rustcrypto, widely audited
quick-xml = "0.36" # Maltego TRX XML round-trip (serde-feature)
quick-xml = "0.41" # Maltego TRX XML round-trip (serde-feature)
safetensors = "0.4" # HuggingFace SAE weight loader (Gemma Scope 2 alignment)
# DB-grade verification + error tracking primitives (wave-4 ingest)

130
jouleclaw/jouleclaw-rs/crates/jouleclaw-transform-trx/src/lib.rs
View file

@ -176,7 +176,11 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
use quick_xml::Reader;
let mut reader = Reader::from_str(xml);
reader.config_mut().trim_text(true);
// Deliberately no `trim_text(true)`: quick-xml reports an entity reference as
// its own event, so one element's text arrives in several pieces and a
// per-piece trim eats the spaces around the entity. The assembled value is
// trimmed once, where it is consumed.
reader.config_mut().trim_text(false);
let mut buf = Vec::new();
let mut entities: Vec<Entity> = Vec::new();
@ -193,6 +197,13 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
// Per-UIMessage scratch.
let mut cur_uimsg_kind: Option<UiMessageKind> = None;
// Character data for the element currently open. quick-xml 0.41 reports an
// entity reference as its own `GeneralRef` event rather than folding it into
// the surrounding text, so one element's content can arrive as several
// events. Accumulating here and consuming it at the matching End is what
// keeps `a &amp; b` from arriving as just `b`.
let mut chars = String::new();
let mut in_value = false;
let mut in_weight = false;
let mut in_field = false;
@ -217,10 +228,17 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
}
}
}
"Value" => in_value = true,
"Weight" => in_weight = true,
"Value" => {
in_value = true;
chars.clear();
}
"Weight" => {
in_weight = true;
chars.clear();
}
"Field" => {
in_field = true;
chars.clear();
for attr in e.attributes().with_checks(false).flatten() {
if attr.key.as_ref() == b"Name" {
let v = attr
@ -232,6 +250,7 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
}
"UIMessage" => {
in_uimsg = true;
chars.clear();
let mut kind = UiMessageKind::Inform;
for attr in e.attributes().with_checks(false).flatten() {
if attr.key.as_ref() == b"Type" {
@ -253,29 +272,58 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
}
}
Ok(Event::Text(t)) => {
let text = t
.unescape()
.map_err(|err| TrxError::Decode(format!("text: {err}")))?
.to_string();
if in_value {
cur_entity_value = Some(text);
} else if in_weight {
cur_entity_weight = text.parse::<f64>().ok();
} else if in_field {
cur_field_value = Some(text);
} else if in_uimsg
&& let Some(kind) = cur_uimsg_kind.take() {
messages.push(UiMessage { kind, text });
// Text now holds no entity reference: 0.41 delivers each one as a
// GeneralRef event below. `xml10_content` decodes the bytes and
// normalizes end-of-line runs; there is nothing left to unescape.
chars.push_str(
&t.xml10_content()
.map_err(|err| TrxError::Decode(format!("text: {err}")))?,
);
}
Ok(Event::GeneralRef(r)) => {
// `&#38;` and `&amp;` both land here. Resolving them is not
// optional: a parser that ignores this event drops the character
// silently, and a property value that should read `{"a":1}` comes
// back as the bare string `{a:1}` — well-formed, wrong, and quiet.
if let Some(ch) = r
.resolve_char_ref()
.map_err(|err| TrxError::Decode(format!("char ref: {err}")))?
{
chars.push(ch);
} else {
let name = r
.decode()
.map_err(|err| TrxError::Decode(format!("entity name: {err}")))?;
match quick_xml::escape::resolve_predefined_entity(&name) {
Some(text) => chars.push_str(text),
// TRX carries no DTD, so there is no legitimate entity
// beyond the five XML predefines. Refuse rather than drop.
None => {
return Err(TrxError::Decode(format!(
"unknown entity reference '&{name};'"
)))
}
}
}
}
Ok(Event::End(ref e)) => {
let name = std::str::from_utf8(e.name().as_ref())
.map_err(|err| TrxError::Decode(format!("utf8: {err}")))?
.to_string();
match name.as_str() {
"Value" => in_value = false,
"Weight" => in_weight = false,
"Value" => {
in_value = false;
cur_entity_value = Some(chars.trim().to_string());
chars.clear();
}
"Weight" => {
in_weight = false;
cur_entity_weight = chars.trim().parse::<f64>().ok();
chars.clear();
}
"Field" => {
cur_field_value = Some(chars.trim().to_string());
chars.clear();
if let (Some(n), Some(v)) =
(cur_field_name.take(), cur_field_value.take())
{
@ -287,7 +335,13 @@ pub fn parse_response(xml: &str) -> Result<TransformResult, TrxError> {
}
"UIMessage" => {
in_uimsg = false;
cur_uimsg_kind = None;
if let Some(kind) = cur_uimsg_kind.take() {
messages.push(UiMessage {
kind,
text: chars.trim().to_string(),
});
chars.clear();
}
}
"Entity" => {
let ty = cur_entity_type
@ -528,6 +582,44 @@ mod tests {
assert!(LOSSY_FIELDS_ON_TRX_ROUND_TRIP.contains(&"activity"));
}
/// Entity references in element text must reach the parsed value.
///
/// quick-xml delivers each `&amp;` / `&#38;` as its own event, so one
/// element's content arrives as several events and a parser that reads only
/// the text events keeps the last fragment and discards the rest. This
/// asserts on XML written by hand rather than by `render_response`, so it
/// still holds if the writer's escaping ever changes.
#[test]
fn entity_references_in_text_reach_the_parsed_value() {
let xml = concat!(
"<MaltegoMessage><MaltegoTransformResponseMessage><Entities>",
r#"<Entity Type="test.X">"#,
"<Value>a &amp; b &#38; c &lt;z&gt;</Value>",
r#"<AdditionalFields><Field Name="n" DisplayName="n">x &apos;q&apos; y</Field></AdditionalFields>"#,
"</Entity></Entities></MaltegoTransformResponseMessage></MaltegoMessage>",
);
let parsed = parse_response(xml).unwrap();
assert_eq!(parsed.entities[0].value, "a & b & c <z>");
assert_eq!(
parsed.entities[0].properties.get("n").unwrap(),
&serde_json::json!("x 'q' y")
);
}
/// An entity name that is not one of the five XML predefines is refused.
///
/// TRX carries no DTD, so `&oops;` cannot be resolved. Dropping it would
/// silently change the value; this asserts the parse fails instead.
#[test]
fn an_unknown_entity_reference_is_refused() {
let xml = concat!(
"<MaltegoMessage><MaltegoTransformResponseMessage><Entities>",
r#"<Entity Type="test.X"><Value>a &oops; b</Value></Entity>"#,
"</Entities></MaltegoTransformResponseMessage></MaltegoMessage>",
);
assert!(parse_response(xml).is_err());
}
#[test]
fn complex_property_value_round_trips_as_json_object() {
let e = Entity::new("e1", "test.X", "v")

34
jouledesk/jouledesk-rs/Cargo.lock generated
View file

@ -624,7 +624,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2034,9 +2034,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.17"
version = "0.11.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
dependencies = [
"bytes",
"getrandom 0.4.3",
@ -2065,7 +2065,7 @@ dependencies = [
"once_cell",
"socket2",
"tracing",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2276,14 +2276,14 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"log",
"once_cell",
@ -2318,9 +2318,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"ring",
"rustls-pki-types",
@ -2645,10 +2645,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
"getrandom 0.4.3",
"getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2739,9 +2739,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -3090,14 +3090,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.9",
"webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
@ -3154,7 +3154,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]

14
joulehook/joulehook-rs/Cargo.lock generated
View file

@ -697,9 +697,9 @@ dependencies = [
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"log",
"once_cell",
@ -721,9 +721,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"ring",
"rustls-pki-types",
@ -999,14 +999,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.9",
"webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]

4
map/map-rs/Cargo.lock generated
View file

@ -1109,9 +1109,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"libc",
"mio",

4
mesh/mesh-rs/Cargo.lock generated
View file

@ -853,9 +853,9 @@ dependencies = [
[[package]]
name = "quick-xml"
version = "0.36.2"
version = "0.41.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe"
checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
dependencies = [
"memchr",
]

1056
openpay/Cargo.lock generated
View file

File diff suppressed because it is too large Load diff

2
openpay/Cargo.toml
View file

@ -76,7 +76,7 @@ open-payments-iso20022 = { version = "=1.0.10", features = ["payments"] }
open-payments-fednow = "=1.0.9"
# XML codec — quick-xml is the de-facto choice; we use it for round-trip
# validation against XSD-canonical sample files.
quick-xml = { version = "0.36", features = ["serialize"] }
quick-xml = { version = "0.41", features = ["serialize"] }
# ML / inference
burn = { version = "0.18", default-features = false }

10
openpay/crates/op-3ds2/Cargo.toml
View file

@ -40,10 +40,12 @@ sha2 = "0.11"
# cipher 0.4 generation the rest of the workspace uses (aes 0.8 / cbc 0.1),
# so the build keeps a single aes + cipher in the graph.
# RSA for legacy issuer ACS public keys, P-256 for the modern
# ECDH-based session key establishment used by the SDK device-binding
# flow.
rsa = "0.9"
# P-256 for the ECDH-based session key establishment used by the SDK
# device-binding flow. There is deliberately no RSA here: the legacy
# issuer-ACS public-key path was never implemented, and the `rsa` crate it
# would have used carries RUSTSEC-2023-0071 (Marvin timing sidechannel) with
# no fixed version available. Reintroducing it needs a constant-time
# implementation, not a version bump.
p256 = { version = "0.13", features = ["ecdh", "ecdsa"] }
# X.509 parsing for DS / ACS certificate chain validation. Each card

105
openpay/crates/op-screening/src/updater.rs
View file

@ -57,6 +57,34 @@ pub struct OfacUpdater {
pub client: reqwest::Client,
}
/// Append a resolved XML entity reference to `out`.
///
/// quick-xml 0.41 delivers `&name;` and `&#nn;` as `Event::GeneralRef` rather
/// than inside the adjacent text, so each one has to be resolved by hand. An
/// unknown name is appended in its original `&name;` form rather than dropped:
/// these feeds carry no DTD, so an unrecognised entity means the input is not
/// what we think it is, and losing the characters silently would quietly alter
/// a sanctioned name. Keeping the literal text makes the anomaly visible to
/// whoever reads the record.
fn push_entity_ref(r: &quick_xml::events::BytesRef<'_>, out: &mut String) {
match r.resolve_char_ref() {
Ok(Some(ch)) => out.push(ch),
Ok(None) => {
let name = r.decode().unwrap_or_default();
match quick_xml::escape::resolve_predefined_entity(&name) {
Some(text) => out.push_str(text),
None => {
out.push('&');
out.push_str(&name);
out.push(';');
}
}
}
Err(_) => {}
}
}
impl Default for OfacUpdater {
fn default() -> Self {
Self {
@ -95,7 +123,13 @@ impl OfacUpdater {
/// ```
pub fn parse_sdn_xml(xml: &str) -> Result<Vec<SanctionedEntity>> {
let mut reader = Reader::from_str(xml);
reader.config_mut().trim_text(true);
// Deliberately no `trim_text(true)`: quick-xml reports an entity
// reference as its own event, so one element's text arrives in several
// pieces and a per-piece trim eats the spaces around the entity —
// "Smith & Co" becomes "Smith&Co". Every consumer below trims the
// assembled value instead, which is the same result for whitespace and
// the correct one for entities.
reader.config_mut().trim_text(false);
let mut entities = Vec::new();
let mut buf = Vec::new();
@ -116,7 +150,16 @@ impl OfacUpdater {
text_buf.clear();
}
Ok(Event::Text(e)) => {
text_buf.push_str(&e.unescape().unwrap_or_default());
text_buf.push_str(&e.xml10_content().unwrap_or_default());
}
Ok(Event::GeneralRef(r)) => {
// quick-xml 0.41 reports every `&amp;` / `&#38;` as its own
// event instead of folding it into the surrounding text, so a
// loop that matches only Event::Text drops it silently. That is
// not cosmetic on this list: an OFAC entry recorded as
// "Smith Co" instead of "Smith & Co" is a screening miss, and
// nothing downstream can tell the difference.
push_entity_ref(&r, &mut text_buf);
}
Ok(Event::End(e)) => {
let name = String::from_utf8_lossy(e.name().as_ref()).to_string();
@ -291,7 +334,13 @@ impl EuUpdater {
/// distinguish persons from entities.
pub fn parse_eu_xml(xml: &str) -> Result<Vec<SanctionedEntity>> {
let mut reader = Reader::from_str(xml);
reader.config_mut().trim_text(true);
// Deliberately no `trim_text(true)`: quick-xml reports an entity
// reference as its own event, so one element's text arrives in several
// pieces and a per-piece trim eats the spaces around the entity —
// "Smith & Co" becomes "Smith&Co". Every consumer below trims the
// assembled value instead, which is the same result for whitespace and
// the correct one for entities.
reader.config_mut().trim_text(false);
let mut entities = Vec::new();
let mut buf = Vec::new();
@ -475,7 +524,13 @@ impl UnUpdater {
/// ```
pub fn parse_un_xml(xml: &str) -> Result<Vec<SanctionedEntity>> {
let mut reader = Reader::from_str(xml);
reader.config_mut().trim_text(true);
// Deliberately no `trim_text(true)`: quick-xml reports an entity
// reference as its own event, so one element's text arrives in several
// pieces and a per-piece trim eats the spaces around the entity —
// "Smith & Co" becomes "Smith&Co". Every consumer below trims the
// assembled value instead, which is the same result for whitespace and
// the correct one for entities.
reader.config_mut().trim_text(false);
let mut entities = Vec::new();
let mut buf = Vec::new();
@ -503,7 +558,16 @@ impl UnUpdater {
text_buf.clear();
}
Ok(Event::Text(e)) => {
text_buf.push_str(&e.unescape().unwrap_or_default());
text_buf.push_str(&e.xml10_content().unwrap_or_default());
}
Ok(Event::GeneralRef(r)) => {
// quick-xml 0.41 reports every `&amp;` / `&#38;` as its own
// event instead of folding it into the surrounding text, so a
// loop that matches only Event::Text drops it silently. That is
// not cosmetic on this list: an OFAC entry recorded as
// "Smith Co" instead of "Smith & Co" is a screening miss, and
// nothing downstream can tell the difference.
push_entity_ref(&r, &mut text_buf);
}
Ok(Event::End(e)) => {
let name = String::from_utf8_lossy(e.name().as_ref()).to_string();
@ -800,6 +864,37 @@ mod tests {
assert_eq!(parsed[1].source_list, WatchList::OfacSdn);
}
/// An entity reference inside a sanctioned name must survive the parse.
///
/// quick-xml reports `&amp;` and `&#38;` as events of their own, so a reader
/// that handles only text drops them without erroring. The name still parses,
/// still looks plausible, and no longer matches the party it names — the
/// failure mode a screening list cannot afford. Both spellings are checked
/// because they travel different code paths: a named predefine and a
/// numeric character reference.
#[test]
fn an_entity_reference_in_a_name_survives_the_sdn_parse() {
let xml = r#"<?xml version="1.0" encoding="UTF-8"?>
<sdnList>
<sdnEntry>
<uid>9999</uid>
<lastName>Smith &amp; Co</lastName>
<sdnType>Entity</sdnType>
<programList><program>SDGT</program></programList>
</sdnEntry>
<sdnEntry>
<uid>10000</uid>
<lastName>Jones &#38; Partners</lastName>
<sdnType>Entity</sdnType>
<programList><program>SDGT</program></programList>
</sdnEntry>
</sdnList>"#;
let parsed = OfacUpdater::parse_sdn_xml(xml).expect("parse");
assert_eq!(parsed.len(), 2);
assert_eq!(parsed[0].name, "Smith & Co");
assert_eq!(parsed[1].name, "Jones & Partners");
}
#[test]
fn parse_minimal_un() {
let xml = r#"<?xml version="1.0" encoding="UTF-8"?>

414
sandbox/sandbox-rs/Cargo.lock generated
View file

@ -82,15 +82,6 @@ version = "2.13.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
[[package]]
name = "bitmaps"
version = "2.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "031043d04099746d8db04daf1fa424b2bc8bd69d92b25962dcde24da39ab64a2"
dependencies = [
"typenum",
]
[[package]]
name = "blake3"
version = "1.8.7"
@ -199,9 +190,9 @@ checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
[[package]]
name = "cpp_demangle"
version = "0.4.5"
version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f2bb79cb74d735044c972aae58ed0aaa9a837e85b01106a54c39e42e97f62253"
checksum = "0667304c32ea56cb4cd6d2d7c0cfe9a2f8041229db8c033af7f8d69492429def"
dependencies = [
"cfg-if",
]
@ -226,27 +217,27 @@ dependencies = [
[[package]]
name = "cranelift-assembler-x64"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "adc822414b18d1f5b1b33ce1441534e311e62fef86ebb5b9d382af857d0272c9"
checksum = "c9c587da2696fbaa58e7a2fa2e5bfdd365d0928219f36992304ac1f15e5bc254"
dependencies = [
"cranelift-assembler-x64-meta",
]
[[package]]
name = "cranelift-assembler-x64-meta"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8c646808b06f4532478d8d6057d74f15c3322f10d995d9486e7dcea405bf521a"
checksum = "f28a60027b7556b680b051651291053ec381edf4ffbc01784997ae51a64269bb"
dependencies = [
"cranelift-srcgen",
]
[[package]]
name = "cranelift-bforest"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7b5996f01a686b2349cdb379083ec5ad3e8cb8767fb2d495d3a4f2ee4163a18d"
checksum = "62bfdb846acebfd591d601994ea283c98d525ac0bc9a84ca3f2c36bcf5b69ff1"
dependencies = [
"cranelift-entity",
"wasmtime-internal-core",
@ -254,9 +245,9 @@ dependencies = [
[[package]]
name = "cranelift-bitset"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "523fea83273f6a985520f57788809a4de2165794d9ab00fb1254fceb4f5aa00c"
checksum = "aa9f8cc1080739d5f72b4ee7e00aff7d589f1284beaf0a19472c07878be7f299"
dependencies = [
"serde",
"serde_derive",
@ -265,9 +256,9 @@ dependencies = [
[[package]]
name = "cranelift-codegen"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d73d1e372730b5f64ed1a2bd9f01fe4686c8ec14a28034e3084e530c8d951878"
checksum = "d85417d493ecec833b5134546b4a252c78cc0bd5be11729a35d25dcff9e4e70b"
dependencies = [
"bumpalo",
"cranelift-assembler-x64",
@ -279,13 +270,16 @@ dependencies = [
"cranelift-entity",
"cranelift-isle",
"gimli",
"hashbrown 0.16.1",
"hashbrown 0.17.1",
"libm",
"log",
"postcard",
"pulley-interpreter",
"regalloc2",
"rustc-hash",
"serde",
"serde_derive",
"sha2",
"smallvec",
"target-lexicon",
"wasmtime-internal-core",
@ -293,9 +287,9 @@ dependencies = [
[[package]]
name = "cranelift-codegen-meta"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b0319c18165e93dc1ebf78946a8da0b1c341c95b4a39729a69574671639bdb5f"
checksum = "d01c8ed0098360bae69ad6b82952d4247516799ce8050d45ad168d6689f4eae6"
dependencies = [
"cranelift-assembler-x64-meta",
"cranelift-codegen-shared",
@ -306,24 +300,24 @@ dependencies = [
[[package]]
name = "cranelift-codegen-shared"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9195cd8aeecb55e401aa96b2eaa55921636e8246c127ed7908f7ef7e0d40f270"
checksum = "04f9b86d809cec9c4e88b201f1b3ed3b0347674c9ccfbb8c355228669e34be81"
[[package]]
name = "cranelift-control"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8976c2154b74136322befc74222ab5c7249edd7e2604f8cbef2b94975541ffb9"
checksum = "ce182038fb10b719841e65fdf5deeee258c684f63439f5be680c2be059274b58"
dependencies = [
"arbitrary",
]
[[package]]
name = "cranelift-entity"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6038b3147c7982f4951150d5f96c7c06c1e7214b99d4b4a98607aadf8ded89d1"
checksum = "7bca812b03a7b942796391f25bc02aa70a1a007fee3ce2756490c788429e9c39"
dependencies = [
"cranelift-bitset",
"serde",
@ -333,11 +327,12 @@ dependencies = [
[[package]]
name = "cranelift-frontend"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4cbd294abe236e23cc3d907b0936226b6a8342db7636daa9c7c72be1e323420e"
checksum = "a0c30563d2aef95e8d1a00a920199c99117b350339599f0e9487a7a1cf5d59de"
dependencies = [
"cranelift-codegen",
"hashbrown 0.17.1",
"log",
"smallvec",
"target-lexicon",
@ -345,15 +340,15 @@ dependencies = [
[[package]]
name = "cranelift-isle"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5a90b6ed3aba84189352a87badeb93b2126d3724225a42dc67fdce53d1b139c"
checksum = "9c54184333a275698edb1d3bdff226131a25d47133d792aa716e47e32b8b7f05"
[[package]]
name = "cranelift-native"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c3ec0cc1a54e22925eacf4fc3dc815f907734d3b377899d19d52bec04863e853"
checksum = "eb67a4c8a3180b5f1d77dffcd6317c05386ced42e5a31c7004523a9d99dc85c1"
dependencies = [
"cranelift-codegen",
"libc",
@ -362,9 +357,9 @@ dependencies = [
[[package]]
name = "cranelift-srcgen"
version = "0.130.2"
version = "0.136.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "948865622f87f30907bb46fbb081b235ae63c1896a99a83c26a003305c1fa82d"
checksum = "b533db1679b4b728568bd490da6533cf50974c48a4d7534e78f1e0e02bc39769"
[[package]]
name = "crc32fast"
@ -854,17 +849,17 @@ name = "hashbrown"
version = "0.16.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
dependencies = [
"foldhash",
"serde",
"serde_core",
]
[[package]]
name = "hashbrown"
version = "0.17.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
dependencies = [
"foldhash",
"serde",
"serde_core",
]
[[package]]
name = "heck"
@ -997,20 +992,6 @@ dependencies = [
"icu_properties",
]
[[package]]
name = "im-rc"
version = "15.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "af1955a75fa080c677d3972822ec4bad316169ab1cfc6c257a942c2265dbe5fe"
dependencies = [
"bitmaps",
"rand_core",
"rand_xoshiro",
"sized-chunks",
"typenum",
"version_check",
]
[[package]]
name = "indexmap"
version = "2.14.0"
@ -1202,12 +1183,9 @@ checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
[[package]]
name = "mach2"
version = "0.4.3"
version = "0.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d640282b302c0bb0a2a8e0233ead9035e3bed871f0b7e81fe4a1ec829765db44"
dependencies = [
"libc",
]
checksum = "dae608c151f68243f2b000364e1f7b186d9c29845f7d2d85bd31b9ad77ad552b"
[[package]]
name = "memchr"
@ -1281,12 +1259,12 @@ dependencies = [
[[package]]
name = "object"
version = "0.38.1"
version = "0.40.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "271638cd5fa9cca89c4c304675ca658efc4e64a66c716b7cfe1afb4b9611dbbc"
checksum = "dd229a0361b9d0d4396176e02d65897f487eebeab7caa6d443855ee152ca0b9c"
dependencies = [
"crc32fast",
"hashbrown 0.16.1",
"hashbrown 0.17.1",
"indexmap",
"memchr",
]
@ -1429,9 +1407,9 @@ dependencies = [
[[package]]
name = "pulley-interpreter"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7ec12fe19a9588315a49fe5704502a9c02d6a198303314b0c7c86123b06d29e5"
checksum = "5cd3de43f4f4cff536de8902097edbdf749321b97dda548f36a37918eb85bba3"
dependencies = [
"cranelift-bitset",
"log",
@ -1441,9 +1419,9 @@ dependencies = [
[[package]]
name = "pulley-macros"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "36f7d5ef31ebf1b46cd7e722ffef934e670d7e462f49aa01cde07b9b76dca580"
checksum = "8319a8fa5269b4895957f8795861c42822bd26218e495f70060a963323d94847"
dependencies = [
"proc-macro2",
"quote",
@ -1495,15 +1473,6 @@ dependencies = [
"getrandom 0.2.17",
]
[[package]]
name = "rand_xoshiro"
version = "0.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6f97cdb2a36ed4183de61b2f824cc45c9f1037f28afe0a322e9fff4c108b5aaa"
dependencies = [
"rand_core",
]
[[package]]
name = "rayon"
version = "1.12.0"
@ -1546,6 +1515,7 @@ dependencies = [
"hashbrown 0.17.1",
"log",
"rustc-hash",
"serde",
"smallvec",
]
@ -1630,9 +1600,9 @@ dependencies = [
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"log",
"once_cell",
@ -1654,9 +1624,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"ring",
"rustls-pki-types",
@ -1669,12 +1639,6 @@ version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
[[package]]
name = "ryu"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
[[package]]
name = "sandbox-attest"
version = "0.1.0"
@ -1994,26 +1958,13 @@ dependencies = [
[[package]]
name = "serde_spanned"
version = "1.1.1"
version = "1.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
dependencies = [
"serde_core",
]
[[package]]
name = "serde_yaml"
version = "0.9.34+deprecated"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
dependencies = [
"indexmap",
"itoa",
"ryu",
"serde",
"unsafe-libyaml",
]
[[package]]
name = "sha1"
version = "0.10.7"
@ -2058,16 +2009,6 @@ version = "0.3.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
[[package]]
name = "sized-chunks"
version = "0.6.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "16d69225bde7a69b235da73377861095455d298f2b970996eec25ddbb42b3d1e"
dependencies = [
"bitmaps",
"typenum",
]
[[package]]
name = "slab"
version = "0.4.12"
@ -2260,9 +2201,9 @@ dependencies = [
[[package]]
name = "toml"
version = "0.9.12+spec-1.1.0"
version = "1.1.8+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
dependencies = [
"indexmap",
"serde_core",
@ -2270,32 +2211,32 @@ dependencies = [
"toml_datetime",
"toml_parser",
"toml_writer",
"winnow 0.7.15",
"winnow",
]
[[package]]
name = "toml_datetime"
version = "0.7.5+spec-1.1.0"
version = "1.1.2+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
dependencies = [
"serde_core",
]
[[package]]
name = "toml_parser"
version = "1.1.3+spec-1.1.0"
version = "1.1.5+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
dependencies = [
"winnow 1.0.4",
"winnow",
]
[[package]]
name = "toml_writer"
version = "1.1.2+spec-1.1.0"
version = "1.1.3+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
[[package]]
name = "typenum"
@ -2315,18 +2256,6 @@ version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
[[package]]
name = "unicode-xid"
version = "0.2.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
[[package]]
name = "unsafe-libyaml"
version = "0.2.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
[[package]]
name = "untrusted"
version = "0.9.0"
@ -2438,53 +2367,61 @@ dependencies = [
[[package]]
name = "wasm-compose"
version = "0.245.1"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5fd23d12cc95c451c1306db5bc63075fbebb612bb70c53b4237b1ce5bc178343"
checksum = "27dc71f96d21a8b9153da9005c603f4f20d5781b7e6d2675ea0ca5def8713b75"
dependencies = [
"anyhow",
"heck",
"im-rc",
"indexmap",
"log",
"petgraph",
"serde",
"serde_derive",
"serde_yaml",
"smallvec",
"wasm-encoder 0.245.1",
"wasmparser 0.245.1",
"wasm-encoder 0.258.3",
"wasmparser 0.258.3",
"wat",
]
[[package]]
name = "wasm-encoder"
version = "0.245.1"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3f9dca005e69bf015e45577e415b9af8c67e8ee3c0e38b5b0add5aa92581ed5c"
checksum = "f64765e43c000fae008a48db8b288e175e237fc9ce20a26586836878c1bee89f"
dependencies = [
"leb128fmt",
"wasmparser 0.245.1",
"wasmparser 0.258.3",
]
[[package]]
name = "wasm-encoder"
version = "0.258.0"
version = "0.262.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e974fe6821a8cf64575d51ea2194e2c8f77e7b66e9afe7419ce8a97f9ee0d251"
checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a"
dependencies = [
"leb128fmt",
"wasmparser 0.258.0",
"wasmparser 0.262.0",
]
[[package]]
name = "wasm-metadata"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "47e10808eb27efde692f1b1706089fe19296728bf872291f5b4e0d50fba88f2f"
dependencies = [
"anyhow",
"indexmap",
"wasm-encoder 0.258.3",
"wasmparser 0.258.3",
]
[[package]]
name = "wasmparser"
version = "0.245.1"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4f08c9adee0428b7bddf3890fc27e015ac4b761cc608c822667102b8bfd6995e"
checksum = "fe9269dd817e0e7021bf534ccd9761bc2d64778b6708e41228b8439d75eaa0b1"
dependencies = [
"bitflags",
"hashbrown 0.16.1",
"hashbrown 0.17.1",
"indexmap",
"semver",
"serde",
@ -2492,9 +2429,9 @@ dependencies = [
[[package]]
name = "wasmparser"
version = "0.258.0"
version = "0.262.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d9a61719f93a87b16d325921e251800c4833f8fab50fa21c7de73aed50086313"
checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
dependencies = [
"bitflags",
"indexmap",
@ -2503,27 +2440,26 @@ dependencies = [
[[package]]
name = "wasmprinter"
version = "0.245.1"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f41517a3716fbb8ccf46daa9c1325f760fcbff5168e75c7392288e410b91ac8"
checksum = "14a457ba8670a3db3d357c1aeac3ed4fe378a76054a221789f0df0ea507e292b"
dependencies = [
"anyhow",
"termcolor",
"wasmparser 0.245.1",
"wasmparser 0.258.3",
]
[[package]]
name = "wasmtime"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "efb1ed5899dde98357cfdcf647a4614498798719793898245b4b34e663addabf"
checksum = "36abb25de5518707e5ba96b586366b09db168d2d4976cb9dac57265a317497ea"
dependencies = [
"addr2line",
"async-trait",
"bitflags",
"bumpalo",
"cc",
"cfg-if",
"encoding_rs",
"futures",
"fxprof-processed-profile",
@ -2547,8 +2483,8 @@ dependencies = [
"target-lexicon",
"tempfile",
"wasm-compose",
"wasm-encoder 0.245.1",
"wasmparser 0.245.1",
"wasm-encoder 0.258.3",
"wasmparser 0.258.3",
"wasmtime-environ",
"wasmtime-internal-cache",
"wasmtime-internal-component-macro",
@ -2560,16 +2496,16 @@ dependencies = [
"wasmtime-internal-jit-icache-coherence",
"wasmtime-internal-unwinder",
"wasmtime-internal-versioned-export-macros",
"wasmtime-internal-winch",
"wat",
"windows-sys 0.61.2",
"wit-parser",
]
[[package]]
name = "wasmtime-environ"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4172382dcc785c31d0e862c6780a18f5dd437914d22c4691351f965ef751c821"
checksum = "92f16a4d09fb1fbf2dcfeddb9818e1517a258e13b505b3bfdadcf47a19bf31ca"
dependencies = [
"anyhow",
"cpp_demangle",
@ -2577,7 +2513,7 @@ dependencies = [
"cranelift-bitset",
"cranelift-entity",
"gimli",
"hashbrown 0.16.1",
"hashbrown 0.17.1",
"indexmap",
"log",
"object",
@ -2589,8 +2525,8 @@ dependencies = [
"sha2",
"smallvec",
"target-lexicon",
"wasm-encoder 0.245.1",
"wasmparser 0.245.1",
"wasm-encoder 0.258.3",
"wasmparser 0.258.3",
"wasmprinter",
"wasmtime-internal-component-util",
"wasmtime-internal-core",
@ -2598,9 +2534,9 @@ dependencies = [
[[package]]
name = "wasmtime-internal-cache"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4ed398988226d7aa0505ac6bb576e09532ad722d702ec4e66365d78ed695c95f"
checksum = "96e4469e885ac50f8dc06337245f9905b22c68d55416267f9afd07f7f76687be"
dependencies = [
"base64",
"directories-next",
@ -2618,9 +2554,9 @@ dependencies = [
[[package]]
name = "wasmtime-internal-component-macro"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ae5ec9fff073ff13b81732d56a9515d761c245750bcda09093827f84130ebc25"
checksum = "d4fca03bd4425856574c0807d1dee16fad43f947feaf4e9ae1d2129596ee4de4"
dependencies = [
"anyhow",
"proc-macro2",
@ -2633,29 +2569,28 @@ dependencies = [
[[package]]
name = "wasmtime-internal-component-util"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "935d9ab293ba27d1ec9aa7bc1b3a43993dbe961af2a8f23f90a11e1331b4c13f"
checksum = "4006009fc3598af4e895ab18c6c33d2c6b7c657b1bd0a755ca7ee1abef6f0c16"
[[package]]
name = "wasmtime-internal-core"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9a3820b174f477d2a7083209d1ad5353fcdb11eaea434b2137b8681029460dd3"
checksum = "947a732ad659f42c10ec639706fc8cb1f068dd9a55eebde8a1f24dfd06dfa525"
dependencies = [
"anyhow",
"hashbrown 0.16.1",
"hashbrown 0.17.1",
"libm",
"serde",
]
[[package]]
name = "wasmtime-internal-cranelift"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d1679d205caf9766c6aa309d45bb3e7c634d7725e3164404df33824b9f7c4fb7"
checksum = "fbfb8b455d524939e03df42e3e749f8e26e26ba2acd8b08fa00b3bda55686750"
dependencies = [
"cfg-if",
"cranelift-codegen",
"cranelift-control",
"cranelift-entity",
@ -2669,7 +2604,7 @@ dependencies = [
"smallvec",
"target-lexicon",
"thiserror 2.0.20",
"wasmparser 0.245.1",
"wasmparser 0.258.3",
"wasmtime-environ",
"wasmtime-internal-core",
"wasmtime-internal-unwinder",
@ -2678,12 +2613,11 @@ dependencies = [
[[package]]
name = "wasmtime-internal-fiber"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1e505254058be5b0df458d670ee42d9eafe2349d04c1296e9dc01071dc20a85"
checksum = "bd8aa8711f68b2cdd94c2b85ba5c8317edaa1ac4ee0a0534b957123680239307"
dependencies = [
"cc",
"cfg-if",
"libc",
"rustix",
"wasmtime-environ",
@ -2693,9 +2627,9 @@ dependencies = [
[[package]]
name = "wasmtime-internal-jit-debug"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1c2e05b345f1773e59c20e6ad7298fd6857cdea245023d88bb659c96d8f0ea72"
checksum = "e873e4504faf50aa8ce255d6ea7210d87b39d5f379c2486782e2c5f179c70ca8"
dependencies = [
"cc",
"object",
@ -2705,11 +2639,10 @@ dependencies = [
[[package]]
name = "wasmtime-internal-jit-icache-coherence"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b86701b234a4643e3f111869aa792b3a05a06e02d486ee9cb6c04dae16b52dab"
checksum = "197ab1fda5da958a5c0b8a97eb241beafc48ac568b82ef4f12f38d6866c74173"
dependencies = [
"cfg-if",
"libc",
"wasmtime-internal-core",
"windows-sys 0.61.2",
@ -2717,11 +2650,10 @@ dependencies = [
[[package]]
name = "wasmtime-internal-unwinder"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f63558d801beb83dde9b336eb4ae049019aee26627926edb32cd119d7e4c83cd"
checksum = "5577f3a5a979a7c3b1b23c1e9f13e70a8583acc8828471ec56f282117fc4952b"
dependencies = [
"cfg-if",
"cranelift-codegen",
"log",
"object",
@ -2730,63 +2662,47 @@ dependencies = [
[[package]]
name = "wasmtime-internal-versioned-export-macros"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "737c4d956fc3a848541a064afb683dd2771132a6b125be5baaf95c4379aa47df"
checksum = "f6399c9c4050ed431cf66e21c05fadd6f9731db44476f452f8c7142b4597b883"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.119",
]
[[package]]
name = "wasmtime-internal-winch"
version = "43.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f599b79545e3bba0b7913406055ebede5bb0dabee9ba2015ef25a9f4c9f47807"
dependencies = [
"cranelift-codegen",
"gimli",
"log",
"object",
"target-lexicon",
"wasmparser 0.245.1",
"wasmtime-environ",
"wasmtime-internal-cranelift",
"winch-codegen",
]
[[package]]
name = "wasmtime-internal-wit-bindgen"
version = "43.0.2"
version = "49.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2192a77a00b9a67800c2b4e1c70fb6abca79d6b529e53a2ef9dcdcc36090330d"
checksum = "b4eaf45d4da7681d234bb6efd846b4a528b08a75384a7fc23f125d0145364b06"
dependencies = [
"anyhow",
"bitflags",
"heck",
"indexmap",
"wit-component",
"wit-parser",
]
[[package]]
name = "wast"
version = "258.0.0"
version = "262.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "97f7defc7ecca8b19ac7f824598eadd0c53985ee00c74060d65051e9da5b58a1"
checksum = "30612a0c29249b5f185888a107e8a519d920226b7d07f9d351fd094e9f75eb23"
dependencies = [
"bumpalo",
"leb128fmt",
"memchr",
"unicode-width",
"wasm-encoder 0.258.0",
"wasm-encoder 0.262.0",
]
[[package]]
name = "wat"
version = "1.258.0"
version = "1.262.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7555c008cca87f2ac58d9f83ccda7e7b44611093ce28eb28f052e7c78024b9bf"
checksum = "e228027f2b07bbaf946980ebbe2437fca73be6f54c40c2a8d4f42f277075f8d1"
dependencies = [
"wast",
]
@ -2797,14 +2713,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.9",
"webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
@ -2840,25 +2756,6 @@ version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
[[package]]
name = "winch-codegen"
version = "43.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "52dbb0cf07b0dfe7b7a1ca8efb8f94ba98bd0fb144c411ea1665c78f0449e958"
dependencies = [
"cranelift-assembler-x64",
"cranelift-codegen",
"gimli",
"regalloc2",
"smallvec",
"target-lexicon",
"thiserror 2.0.20",
"wasmparser 0.245.1",
"wasmtime-environ",
"wasmtime-internal-core",
"wasmtime-internal-cranelift",
]
[[package]]
name = "windows-link"
version = "0.2.1"
@ -2947,12 +2844,6 @@ version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
[[package]]
name = "winnow"
version = "0.7.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
[[package]]
name = "winnow"
version = "1.0.4"
@ -2960,13 +2851,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
[[package]]
name = "wit-parser"
version = "0.245.1"
name = "wit-component"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "330698718e82983499419494dd1e3d7811a457a9bf9f69734e8c5f07a2547929"
checksum = "f0fca88950af0c1f42bc77e17315e48798b8d68340171b6d204f62bc19a878a6"
dependencies = [
"anyhow",
"hashbrown 0.16.1",
"bitflags",
"indexmap",
"log",
"serde",
"serde_derive",
"serde_json",
"wasm-encoder 0.258.3",
"wasm-metadata",
"wasmparser 0.258.3",
"wit-parser",
]
[[package]]
name = "wit-parser"
version = "0.258.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "72a2127663dcf3ee16614fb0e3c33d5c6c66fec9dad317a8b0fdd3869487a533"
dependencies = [
"anyhow",
"hashbrown 0.17.1",
"id-arena",
"indexmap",
"log",
@ -2974,8 +2884,8 @@ dependencies = [
"serde",
"serde_derive",
"serde_json",
"unicode-xid",
"wasmparser 0.245.1",
"unicode-ident",
"wasmparser 0.258.3",
]
[[package]]

2
sandbox/sandbox-rs/Cargo.toml
View file

@ -40,7 +40,7 @@ sandbox-conformance = { path = "crates/sandbox-conformance" }
sandbox-proof = { path = "crates/sandbox-proof" }
sandbox-build = { path = "crates/sandbox-build" }
wasmtime = "43"
wasmtime = "49"
p384 = { version = "0.13", default-features = false, features = ["ecdsa", "sha384"] }
p256 = { version = "0.13", default-features = false, features = ["ecdsa"] }
sha2 = { version = "0.10", default-features = false }

2
sandbox/sandbox-rs/crates/sandbox-exec-wasm/src/lib.rs
View file

@ -135,7 +135,7 @@ impl WasmExecutor {
/// and `wasmtime_version_matches_the_lockfile` fails the build if it drifts. A
/// stale value here would silently attest confinement to the wrong runtime,
/// which is precisely the class of untruth §7.9 exists to prevent.
pub const WASMTIME_VERSION: &str = "43.0.2";
pub const WASMTIME_VERSION: &str = "49.0.4";
impl Executor for WasmExecutor {
fn tier(&self) -> Tier {

81
scripts/check-advisories-selftest.sh Executable file
View file

@ -0,0 +1,81 @@
#!/usr/bin/env bash
#
# check-advisories-selftest.sh — check-advisories.py can fail.
#
# A check that cannot fail is decoration. This feeds the check pre-captured
# `cargo audit --json` documents through `--from-json` and asserts that it
# 1. passes when every advisory found is allowed and every allowed advisory
# is found;
# 2. fails when an advisory is reported that the allow list does not name
# (the case this check exists for);
# 3. fails when an allow-list entry matches nothing, so an excuse cannot
# outlive the exposure it was written for;
# 4. fails, and says it could not audit, when the document does not parse:
# an error is never read as "clean".
#
# Nothing here runs cargo or reads the advisory database, so it needs no
# network and no lockfile.
set -uo pipefail
here=$(cd "$(dirname "$0")" && pwd)
check="$here/check-advisories.py"
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
# Every advisory the check allows, read from the check itself so the two cannot
# drift apart.
# (a read loop, not `mapfile`: macOS ships bash 3.2, where mapfile does not exist)
allowed=()
while IFS= read -r id; do allowed+=("$id"); done < <(
grep -oE '^ "RUSTSEC-[0-9]{4}-[0-9]{4}"' "$check" | tr -d ' "'
)
if [ ${#allowed[@]} -eq 0 ]; then
echo "selftest: could not read the allow list out of $check" >&2
exit 2
fi
# write_json <file> <id>... — a cargo-audit document reporting exactly these.
write_json() {
local out=$1; shift
{ printf '{"vulnerabilities":{"found":true,"count":%d,"list":[' "$#"
local first=1 id
for id in "$@"; do
[ $first -eq 1 ] || printf ','
first=0
printf '{"advisory":{"id":"%s","title":"t"},"package":{"name":"c","version":"1.0.0"}}' "$id"
done
printf ']},"warnings":{}}'
} > "$out"
}
fails=0
expect() { # expect <pass|fail> <what> [text the output must hold] -- <args...>
local want=$1 what=$2 needle=$3; shift 3; [ "${1:-}" = -- ] && shift
local out rc
out=$(python3 -I "$check" --from-json "$@" 2>&1); rc=$?
if [ "$want" = pass ] && [ $rc -ne 0 ]; then
echo "FAIL $what: the check failed"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return
fi
if [ "$want" = fail ] && [ $rc -eq 0 ]; then
echo "FAIL $what: the check passed"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return
fi
if [ -n "$needle" ] && ! grep -q -- "$needle" <<<"$out"; then
echo "FAIL $what: the output does not say '$needle'"; printf '%s\n' "$out" | sed 's/^/ /'; fails=$((fails+1)); return
fi
echo "ok $what"
}
write_json "$tmp/all.json" "${allowed[@]}"
expect pass "every advisory allowed and every allowance used passes" "" -- "$tmp/all.json"
write_json "$tmp/extra.json" "${allowed[@]}" "RUSTSEC-2099-0001"
expect fail "an advisory the allow list does not name fails" "not in the allow list" -- "$tmp/extra.json"
write_json "$tmp/short.json" "${allowed[@]:1}"
expect fail "an allowance that matches nothing fails" "no longer match anything" -- "$tmp/short.json"
printf 'this is not json\n' > "$tmp/broken.json"
expect fail "a document that does not parse fails as unaudited, not as clean" "Could not be audited" -- "$tmp/broken.json"
if [ $fails -ne 0 ]; then echo "check-advisories-selftest: $fails failure(s)"; exit 1; fi
echo "check-advisories-selftest: the check passes a reviewed tree and fails each way it should."

228
scripts/check-advisories.py Executable file
View file

@ -0,0 +1,228 @@
#!/usr/bin/env python3
#
# check-advisories.py — no workspace carries a security advisory nobody has read.
#
# This tree holds many workspaces, and a vulnerable crate usually arrives
# transitively, in a lockfile nobody edited, for a reason nobody chose. Without
# a gate the backlog only grows, and it grew: a sweep in October 2026 found 142
# vulnerability instances across 47 lockfiles, among them a WASM runtime with a
# filesystem sandbox escape in the one component whose job is confinement.
# Nothing had failed, because nothing was looking.
#
# For every tracked Cargo.lock this runs
#
# cargo audit --file <lock> --json
#
# and fails on any advisory that is not in ALLOW below. It reads the advisory
# database and the lockfile; it builds nothing.
#
# ALLOW is the whole point. An advisory may be left in place — upstream has no
# fixed release, or the vulnerable call is unreachable here — but only in
# writing, with the reason next to the id. Two rules keep that honest:
#
# * an advisory that is not listed fails the run, so a new one has to be
# looked at rather than accumulated;
# * a listed advisory that no longer appears anywhere ALSO fails the run, so
# an entry cannot outlive the exposure it excused. An allow list that is
# never pruned stops describing the tree and starts hiding it.
#
# Warnings (unmaintained, unsound, yanked) are counted and printed but do not
# fail the run: they are advice about maintenance, not a reachable defect, and
# gating on them would bury the vulnerabilities in noise. They are printed so
# the number stays visible rather than unknown.
#
# check-advisories.py every tracked Cargo.lock, less SKIP
# check-advisories.py DIR ... exactly these directories
# check-advisories.py --from-json F... audit JSON already captured (self-test)
#
# Exit 0: every advisory found is allowed, and every allowed advisory was found.
# Exit 1: otherwise — including when a lockfile could not be audited at all,
# which is reported under its own heading so an error is never read as "clean".
import json
import os
import subprocess
import sys
# Advisories left in place on purpose. Each needs the reason, and each must
# still be reported by at least one lockfile or this check fails.
ALLOW = {
# ── Unreachable here ────────────────────────────────────────────────────
# All three are faults in `extract()`: SUID/SGID bits preserved from the
# archive, symlinks whose targets escape the destination, and permissions
# applied through those symlinks. Nothing in this tree extracts an archive
# — there is no `ZipArchive` or `ZipStreamReader` call site. zip arrives
# under candle-core and the wasm toolchain.
"RUSTSEC-2026-0367": "zip: extract-only; nothing here extracts an archive",
"RUSTSEC-2026-0368": "zip: extract-only; nothing here extracts an archive",
"RUSTSEC-2026-0369": "zip: extract-only; nothing here extracts an archive",
"RUSTSEC-2025-0168": "zip: extract-only path canonicalization; nothing here extracts",
# The Marvin attack recovers an RSA key from the timing of private-key
# decryption. There is no fixed release of `rsa` at all. It reaches
# sandbox-rs and wai-rs transitively and neither holds an RSA private key
# nor decrypts: openpay's unused direct dependency was removed outright.
"RUSTSEC-2023-0071": "rsa: no fixed release; no private-key decryption here",
# ── Not in a shipped artifact ──────────────────────────────────────────
# The production MLS path (joule-moq-mls) resolves the patched hpke-rs
# 0.7.0. These four are the old 0.2.0, reached only through a
# [dev-dependencies] edge of joule-code-collab, which still pins the
# openmls 0.6/0.3 stack. Test graph only; aligning it to the 0.9.1/0.6.0
# stack already used in-repo would remove them.
"RUSTSEC-2026-0069": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
"RUSTSEC-2026-0070": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
"RUSTSEC-2026-0071": "hpke-rs 0.2.0: dev-dependency only; production uses 0.7.0",
"RUSTSEC-2026-0072": "hpke-rs-rust-crypto 0.2.0: dev-dependency only",
# ── Pinned by a dependency; needs an upstream release ──────────────────
# hpke-rs-libcrux pins `=0.7.0`, which pins libcrux-kem 0.0.9. Both are
# panics on short or malformed hybrid keys — denial of service, not memory
# corruption. Fixed by an openmls/hpke-rs release, not from here.
"RUSTSEC-2026-0330": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
"RUSTSEC-2026-0331": "libcrux-kem: pinned by hpke-rs-libcrux =0.7.0; upstream",
# quick-xml is 0.41 everywhere the version is ours to choose. openpay also
# resolves 0.37.5 through open-payments-iso20022 1.0.10 (no later release
# exists), and smart-byte resolves 0.39.4 through plist -> netdev ->
# netwatch -> iroh. NOTE: the openpay path is the same ISO 20022 surface we
# harden directly, so this entry is a known remaining exposure on a payment
# ingestion path, not a dismissal. Drop it the moment upstream ships.
"RUSTSEC-2026-0194": "quick-xml 0.37.5/0.39.4: pinned by open-payments-iso20022 and iroh",
"RUSTSEC-2026-0195": "quick-xml 0.37.5/0.39.4: NsReader unused here; dependents pin the version",
# h2 0.3.27 under jouleclaw and 0.4.14 under smart-byte, both transitive;
# the fix is a major move for the dependent.
"RUSTSEC-2026-0258": "h2: transitive; fixed version is a major move for the dependent",
# hickory-proto 0.25.2 under smart-byte via iroh. -0118 has no fixed
# release; -0119 needs 0.26, which iroh does not take yet.
"RUSTSEC-2026-0118": "hickory-proto: no fixed release; transitive under iroh",
"RUSTSEC-2026-0119": "hickory-proto: 0.26 not taken by iroh yet",
# pyo3 0.28.3 under eoc-rs. Both need 0.29, a breaking move for the binding.
"RUSTSEC-2026-0176": "pyo3: 0.29 is a breaking move for the binding",
"RUSTSEC-2026-0177": "pyo3: 0.29 is a breaking move for the binding",
}
# Lockfiles cargo does not read: a vendored crate's own lock, kept with the
# vendored source. Each must still exist, or the entry is stale.
SKIP = (
"jouledesk/jouledesk-rs/vendor/libwebrtc",
"joule-code/joule-code-rs/vendor/wtransport",
)
def discover():
root = subprocess.run(
["git", "rev-parse", "--show-toplevel"], capture_output=True, text=True
).stdout.strip()
if not root:
sys.exit("check-advisories: not in a git checkout.")
os.chdir(root)
for d in SKIP:
if not os.path.isfile(os.path.join(d, "Cargo.lock")):
sys.exit(
f"check-advisories: the skip list names {d}, which holds no "
"Cargo.lock. Remove the entry."
)
out = subprocess.run(["git", "ls-files"], capture_output=True, text=True).stdout
locks = [
p
for p in out.splitlines()
if p == "Cargo.lock" or p.endswith("/Cargo.lock")
if os.path.dirname(p) not in SKIP
]
return sorted(locks)
def audit(lock):
"""Return (parsed_json, error_text). Exactly one is None."""
try:
p = subprocess.run(
["cargo", "audit", "--file", lock, "--json", "--color", "never"],
capture_output=True,
text=True,
timeout=600,
)
except FileNotFoundError:
return None, "cargo is not on PATH"
except subprocess.TimeoutExpired:
return None, "cargo audit timed out"
# cargo audit exits non-zero when it finds something, so the exit status is
# not the signal; absence of parseable JSON is.
try:
return json.loads(p.stdout), None
except json.JSONDecodeError:
tail = (p.stderr or p.stdout or "").strip().splitlines()
return None, "; ".join(tail[-3:]) or "no JSON on stdout"
def main():
args = sys.argv[1:]
from_json = False
if args and args[0] == "--from-json":
from_json, args = True, args[1:]
if from_json:
sources = [(f, None) for f in args]
elif args:
sources = [(os.path.join(d, "Cargo.lock"), None) for d in args]
else:
sources = [(l, None) for l in discover()]
if not sources:
sys.exit("check-advisories: found no Cargo.lock to check.")
found = {} # id -> [(crate, version, lock)]
unchecked = [] # (lock, why)
warn_count = 0
for lock, _ in sources:
if from_json:
try:
with open(lock) as fh:
data, err = json.load(fh), None
except Exception as e: # noqa: BLE001
data, err = None, str(e)
else:
data, err = audit(lock)
if data is None:
unchecked.append((lock, err))
continue
for v in (data.get("vulnerabilities") or {}).get("list") or []:
adv, pkg = v.get("advisory") or {}, v.get("package") or {}
found.setdefault(adv.get("id", "?"), []).append(
(pkg.get("name", "?"), pkg.get("version", "?"), lock)
)
for kind, items in (data.get("warnings") or {}).items():
warn_count += len(items or [])
unexpected = {k: v for k, v in found.items() if k not in ALLOW}
stale = [k for k in ALLOW if k not in found]
if unexpected:
print("Advisories that are not in the allow list:\n")
for adv in sorted(unexpected):
for crate, ver, lock in unexpected[adv]:
print(f" {adv} {crate} {ver}")
print(f" {lock}")
print(
"\nFix each, or add it to ALLOW in scripts/check-advisories.py with the\n"
"reason it can be left — unreachable, dev-only, or pinned upstream."
)
if stale:
print("\nAllow-list entries that no longer match anything:\n")
for adv in sorted(stale):
print(f" {adv} — {ALLOW[adv]}")
print(
"\nThe exposure is gone. Remove the entry, so the list keeps describing\n"
"the tree instead of hiding it."
)
if unchecked:
print("\nCould not be audited (this is not a verdict on the lockfile):\n")
for lock, why in unchecked:
print(f" {lock}: {why}")
if unexpected or stale or unchecked:
return 1
print(
f"check-advisories: {len(sources)} lockfiles, "
f"{len(found)} allowed advisories, {warn_count} warnings (not gated)."
)
return 0
if __name__ == "__main__":
sys.exit(main())

57
smart-byte/smart-byte-rs/Cargo.lock generated
View file

@ -1024,9 +1024,9 @@ dependencies = [
[[package]]
name = "crossbeam-epoch"
version = "0.9.18"
version = "0.9.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
dependencies = [
"crossbeam-utils",
]
@ -1218,7 +1218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
dependencies = [
"data-encoding",
"syn 2.0.117",
"syn 1.0.109",
]
[[package]]
@ -1564,7 +1564,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2377,7 +2377,7 @@ dependencies = [
"libc",
"percent-encoding",
"pin-project-lite",
"socket2 0.6.3",
"socket2 0.5.10",
"tokio",
"tower-service",
"tracing",
@ -4065,7 +4065,7 @@ dependencies = [
"pin-project-lite",
"rustc-hash",
"rustls",
"socket2 0.6.3",
"socket2 0.5.10",
"thiserror 2.0.18",
"tokio",
"tokio-stream",
@ -4110,7 +4110,7 @@ checksum = "78633d1fe1bde91d12bcabb230ac9edb890857414c6d44f3212e0d309525b5ff"
dependencies = [
"cfg_aliases",
"libc",
"socket2 0.6.3",
"socket2 0.5.10",
"tracing",
"windows-sys 0.61.2",
]
@ -4906,7 +4906,7 @@ dependencies = [
"quinn-udp",
"rustc-hash",
"rustls",
"socket2 0.6.3",
"socket2 0.5.10",
"thiserror 2.0.18",
"tokio",
"tracing",
@ -4915,15 +4915,16 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.14"
version = "0.11.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
dependencies = [
"aws-lc-rs",
"bytes",
"getrandom 0.3.4",
"getrandom 0.4.2",
"lru-slab",
"rand 0.9.4",
"rand 0.10.1",
"rand_pcg",
"ring",
"rustc-hash",
"rustls",
@ -4944,7 +4945,7 @@ dependencies = [
"cfg_aliases",
"libc",
"once_cell",
"socket2 0.6.3",
"socket2 0.5.10",
"tracing",
"windows-sys 0.52.0",
]
@ -5342,14 +5343,14 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
name = "rustls"
version = "0.23.40"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"aws-lc-rs",
"log",
@ -5401,7 +5402,7 @@ dependencies = [
"security-framework",
"security-framework-sys",
"webpki-root-certs",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -5412,9 +5413,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
version = "0.103.13"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@ -5557,7 +5558,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -6537,7 +6538,7 @@ dependencies = [
"getrandom 0.4.2",
"once_cell",
"rustix",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -6650,9 +6651,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
[[package]]
name = "tokio"
version = "1.52.3"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -7215,18 +7216,18 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.7"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "webpki-roots"
version = "1.0.7"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
@ -7259,7 +7260,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]

4
wai/tools/ops-gpu-bench/Cargo.lock generated
View file

@ -952,9 +952,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.54.0"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"pin-project-lite",
]

4
wai/tools/quantum-meter/Cargo.lock generated
View file

@ -984,9 +984,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.2"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"pin-project-lite",
]

4
wai/wai-ops-gpu/Cargo.lock generated
View file

@ -678,9 +678,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.54.0"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"pin-project-lite",
]

12
wai/wai-quantum-desktop/Cargo.lock generated
View file

@ -622,7 +622,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
dependencies = [
"quote",
"syn 3.0.9",
"syn 2.0.119",
]
[[package]]
@ -979,7 +979,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -2845,7 +2845,7 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]
@ -3766,9 +3766,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
[[package]]
name = "tokio"
version = "1.54.0"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
@ -4408,7 +4408,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.52.0",
]
[[package]]

4
wai/wai-quantum-service/Cargo.lock generated
View file

@ -764,9 +764,9 @@ checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
[[package]]
name = "tokio"
version = "1.53.3"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",

4
wai/wai-quantum/Cargo.lock generated
View file

@ -1046,9 +1046,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.2"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"pin-project-lite",
]

4
wai/wai-relay/Cargo.lock generated
View file

@ -927,9 +927,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",

26
wai/wai-rs/Cargo.lock generated
View file

@ -1295,7 +1295,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.52.0",
"windows-sys 0.61.2",
]
[[package]]
@ -3354,14 +3354,14 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
"windows-sys 0.52.0",
"windows-sys 0.61.2",
]
[[package]]
name = "rustls"
version = "0.23.43"
version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"log",
"once_cell",
@ -3411,7 +3411,7 @@ dependencies = [
"security-framework",
"security-framework-sys",
"webpki-root-certs",
"windows-sys 0.52.0",
"windows-sys 0.61.2",
]
[[package]]
@ -3422,9 +3422,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"ring",
"rustls-pki-types",
@ -3937,7 +3937,7 @@ dependencies = [
"getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.52.0",
"windows-sys 0.61.2",
]
[[package]]
@ -4430,18 +4430,18 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
[[package]]
name = "webpki-roots"
version = "1.0.9"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
@ -4621,7 +4621,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.52.0",
"windows-sys 0.61.2",
]
[[package]]

4
wai/wai-rs/fuzz/Cargo.lock generated
View file

@ -357,9 +357,9 @@ dependencies = [
[[package]]
name = "crossbeam-epoch"
version = "0.9.21"
version = "0.9.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
dependencies = [
"crossbeam-utils",
]

4
wai/wai-spz-gen/Cargo.lock generated
View file

@ -904,9 +904,9 @@ dependencies = [
[[package]]
name = "tokio"
version = "1.53.1"
version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",