| Filename | Latest commit message | Latest commit date |
|---|---|---|
8fc1d07940
All checks were successful
standards workspaces build + test / which workspaces this change touches (pull_request) Successful in 2m30s
standards workspaces build + test / macOS energy backends (pull_request) Has been skipped
standards workspaces build + test / smart-byte-rs (smart-byte/smart-byte-rs, smart-byte-rs, linux) (pull_request) Successful in 3m35s
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (pull_request) Successful in 22m1s
Two follow-ups to my own work in #449. **The fix shipped on a yanked release.** #449 bumped crypto-bigint 0.7.3 -> 0.7.6 in smart-byte to clear RUSTSEC-2026-0387 (secret-dependent branches in operations meant to be constant-time). The author has since yanked every 0.7.x below 0.7.9 — 0.7.1 through 0.7.8, 0.7.6 among them — so the version chosen to fix an advisory is now withdrawn. Moved to 0.7.10, which is not yanked and still satisfies the advisory's `>=0.7.6`. No yanked dependency remains anywhere in the tree. The pin was correct when it was made and went stale for a reason outside the tree, which is the argument for re-reading the yanked list after advisory work rather than once. **An omission in the gate, turned into a decision.** The header said warnings are not gated because they are "advice about maintenance, not a reachable defect". That is honest for `unmaintained` and evasive for the other two, both of which have been worth acting on. It now says what is true: - unsound-with-a-fix is a real defect a bump would close; one was a use-after-free in `LruCache::pop()`. It is not gated *today* only because every current instance is either pinned by a dependent (zstd-safe under wasmtime 49's module cache, which nothing here configures) or needs a semver-major move of a transitive crate (lru, rand, glib). A gate that is red for things nobody can act on teaches people to bypass it, which costs more than it catches. The trigger to gate it is those becoming movable. - yanked can happen to a version that was correct when chosen, as above. Gating it would turn every PR red for a decision made outside the tree, so it stays a warning — but it is a standing review item, which is how this one was caught. Recorded decisions with trigger conditions, rather than an unexamined gap. 60 lockfiles, the same 19 allowances, self-test green on all six cases, lockfile check current, smart-byte checks clean. Co-Authored-By: Claude Opus 5 <[email protected]> |
||
| .. | ||
| check-advisories-selftest.sh | ||
| check-advisories.py | ||
| check-comparative-prose.sh | ||
| check-fabric-errors.py | ||
| check-lockfiles-selftest.sh | ||
| check-lockfiles.sh | ||
| check-metal-shaders.py | ||
| check-no-vanity-metrics.sh | ||
| check-orphan-sources.py | ||
| check-public-names.sh | ||
| check-spec-refs-selftest.sh | ||
| check-spec-refs.py | ||
| check-tests-in-ci-selftest.sh | ||
| check-tests-in-ci.py | ||
| check-wai-ops-doors-selftest.sh | ||
| check-wai-ops-doors.py | ||
| check-wai-section-refs.py | ||
| check-workflow-concurrency-selftest.sh | ||
| check-workflow-concurrency.sh | ||
| install-hooks.sh | ||
| pr-touches-paths-selftest.sh | ||
| pr-touches-paths.py | ||
| standards-touched-selftest.sh | ||
| standards-touched.py | ||
| test-public-text-checks.sh | ||
| wai-quantum-webgpu-member.sh | ||