Transaction-Science/open-standards
Watch
1
0
Fork
You've already forked open-standards
 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

sec: move crypto-bigint off a release yanked after it was picked, and record why warnings are not gated #565

Merged
dcharlot merged 1 commit from sec/crypto-bigint-unyanked into main 2026-11-01 13:32:10 -05:00
Conversation 0 Commits 1 Files changed 2 +30 -10
2 changed files with 30 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/check-advisories.py
View file

@ -27,9 +27,29 @@
# never pruned stops describing the tree and starts hiding it.
#
# Warnings (unmaintained, unsound, yanked) are counted and printed but do not
# fail the run: they are advice about maintenance, not a reachable defect, and
# gating on them would bury the vulnerabilities in noise. They are printed so
# the number stays visible rather than unknown.
# fail the run, and the count is printed so the number stays visible rather
# than unknown. For `unmaintained` that is easy: it is advice about a crate's
# future, not a reachable defect.
#
# `unsound` and `yanked` deserve a straighter answer, because neither is mere
# maintenance advice and both have been worth acting on:
#
# * unsound-with-a-fix is a real defect a bump would close — one of them was
# a use-after-free in `LruCache::pop()`. It is not gated **today** only
# because every current instance is either pinned by a dependent
# (zstd-safe under wasmtime 49's module cache, which nothing here
# configures) or needs a semver-major move of a transitive crate (lru,
# rand, glib). A gate that is red for things nobody can act on teaches
# people to bypass it, which costs more than it catches. Gate it once
# those can actually move.
# * yanked means the author withdrew a release, which can happen to a
# version that was correct when it was chosen: `crypto-bigint 0.7.6` was
# picked here to fix RUSTSEC-2026-0387 and was yanked afterwards, along
# with every 0.7.x below 0.7.9. Gating it would turn every PR red for a
# decision made outside the tree, so it stays a warning — but it is worth
# re-reading after any advisory work, which is how that one was caught.
#
# Both are therefore a standing review item, not an oversight.
#
# check-advisories.py every tracked Cargo.lock, less SKIP
# check-advisories.py DIR ... exactly these directories

14
smart-byte/smart-byte-rs/Cargo.lock generated
View file

@ -857,9 +857,9 @@ dependencies = [
[[package]]
name = "cmov"
version = "0.5.3"
version = "0.5.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
[[package]]
name = "cobs"
@ -1045,9 +1045,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
[[package]]
name = "crypto-bigint"
version = "0.7.6"
version = "0.7.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0"
checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11"
dependencies = [
"cpubits",
"ctutils",
@ -1090,9 +1090,9 @@ dependencies = [
[[package]]
name = "ctutils"
version = "0.4.5"
version = "0.4.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
dependencies = [
"cmov",
"subtle",
@ -1218,7 +1218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
dependencies = [
"data-encoding",
"syn 2.0.117",
"syn 1.0.109",
]
[[package]]