Skip to content

Commit 1902adf

Browse files
gabriel-aranha-cwgabriel-aranha-cw
authored
chore: bump alloy-primitives (#2422)
1 parent 9e7153a commit 1902adf

5 files changed

Lines changed: 86 additions & 26 deletions

File tree

‎Cargo.lock‎

Lines changed: 17 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ revm-inspectors = { version = "=0.31.2", features = ["js-tracer"] }
7979
alloy-rpc-types-trace = "=1.0.38"
8080
alloy-rpc-types-eth = "=1.0.38"
8181
alloy-consensus = { version = "=1.0.41", features = ["k256"] }
82-
alloy-primitives = { version = "=1.4.1", features = ["rand"] }
82+
alloy-primitives = { version = "=1.5.2", features = ["rand"] }
8383
alloy-eips = "=1.1.0"
8484

8585
# network

‎supply-chain/audits.toml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,12 @@ criteria = "safe-to-deploy"
7676
delta = "1.3.1 -> 1.4.1"
7777
notes = "Reviewed 1.3.1->1.4.1: database trait impls and helpers, no unsafe changes."
7878

79+
[[audits.alloy-primitives]]
80+
who = "gabriel-aranha-cw <gabriel.aranha@cloudwalk.io>"
81+
criteria = "safe-to-deploy"
82+
delta = "1.4.1 -> 1.5.2"
83+
notes = "Reviewed 1.4.1->1.5.2: new keccak cache using rapidhash/fixed-cache, map hasher switches to FxHasher with unsafe length preconditions enforced via assert_unchecked; added keccak cache entry points and address/bloom helpers. No new ambient capabilities beyond hashing and fixed cache; unsafe confined to length-checked hashing and cache key construction."
84+
7985
[[audits.alloy-rpc-types-eth]]
8086
who = "gabriel-aranha-cw <gabriel.aranha@cloudwalk.io>"
8187
criteria = "safe-to-deploy"
@@ -261,6 +267,12 @@ notes = """
261267
Assessment: Low-risk patch, implementation consistent with prior vetted version. Safe to deploy.
262268
"""
263269

270+
[[audits.rapidhash]]
271+
who = "gabriel-aranha-cw <gabriel.aranha@cloudwalk.io>"
272+
criteria = "safe-to-deploy"
273+
version = "4.2.0"
274+
notes = "Inspected 4.2.0: pure hashing crate; default build keeps safety checks. Unsafe usage limited to guarded pointer reads in util::read with explicit length assertions; no I/O or syscalls."
275+
264276
[[audits.revm]]
265277
who = "gabriel-aranha-cw <gabriel.aranha@cloudwalk.io>"
266278
criteria = "safe-to-deploy"
@@ -369,6 +381,12 @@ criteria = "safe-to-deploy"
369381
delta = "1.27.0 -> 1.28.0"
370382
notes = "Reviewed 1.27.0->1.28.0: feature reorg, serde/borsh modules; no unsafe changes."
371383

384+
[[audits.ruint]]
385+
who = "gabriel-aranha-cw <gabriel.aranha@cloudwalk.io>"
386+
criteria = "safe-to-deploy"
387+
delta = "1.16.0 -> 1.17.2"
388+
notes = "Reviewed 1.16.0->1.17.2: functions depending on reciprocal division now marked unsafe and call sites updated; MSRV bumped, serde_core split; added ark-ff 0.5 support and minor API cleanups. Unsafe blocks guarded by explicit precondition checks; no new ambient capabilities."
389+
372390
[[audits.syn-solidity]]
373391
who = "gabriel-aranha-cw <gabriel.aranha@cloudwalk.io>"
374392
criteria = "safe-to-deploy"

‎supply-chain/config.toml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -480,10 +480,6 @@ criteria = "safe-to-deploy"
480480
version = "6.1.0"
481481
criteria = "safe-to-deploy"
482482

483-
[[exemptions.der]]
484-
version = "0.7.10"
485-
criteria = "safe-to-deploy"
486-
487483
[[exemptions.derivative]]
488484
version = "2.2.0"
489485
criteria = "safe-to-deploy"
@@ -1024,10 +1020,6 @@ criteria = "safe-to-deploy"
10241020
version = "1.70.1"
10251021
criteria = "safe-to-deploy"
10261022

1027-
[[exemptions.oneshot]]
1028-
version = "0.1.11"
1029-
criteria = "safe-to-deploy"
1030-
10311023
[[exemptions.openssl]]
10321024
version = "0.10.73"
10331025
criteria = "safe-to-deploy"
@@ -1068,10 +1060,6 @@ criteria = "safe-to-deploy"
10681060
version = "1.0.15"
10691061
criteria = "safe-to-deploy"
10701062

1071-
[[exemptions.pem-rfc7468]]
1072-
version = "0.7.0"
1073-
criteria = "safe-to-deploy"
1074-
10751063
[[exemptions.pest]]
10761064
version = "2.8.1"
10771065
criteria = "safe-to-deploy"
@@ -1104,10 +1092,6 @@ criteria = "safe-to-deploy"
11041092
version = "0.10.2"
11051093
criteria = "safe-to-deploy"
11061094

1107-
[[exemptions.pkg-config]]
1108-
version = "0.3.32"
1109-
criteria = "safe-to-deploy"
1110-
11111095
[[exemptions.plist]]
11121096
version = "1.7.4"
11131097
criteria = "safe-to-deploy"
@@ -1684,10 +1668,6 @@ criteria = "safe-to-deploy"
16841668
version = "0.4.2"
16851669
criteria = "safe-to-deploy"
16861670

1687-
[[exemptions.utf-8]]
1688-
version = "0.7.6"
1689-
criteria = "safe-to-deploy"
1690-
16911671
[[exemptions.uuid]]
16921672
version = "1.18.1"
16931673
criteria = "safe-to-deploy"

‎supply-chain/imports.lock‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -587,6 +587,12 @@ who = "Benjamin Bouvier <public@benj.me>"
587587
criteria = "safe-to-deploy"
588588
version = "0.1.3"
589589

590+
[[audits.bytecode-alliance.audits.der]]
591+
who = "Chris Fallin <chris@cfallin.org>"
592+
criteria = "safe-to-deploy"
593+
version = "0.7.10"
594+
notes = "No unsafe code aside from transmutes for transparent newtypes."
595+
590596
[[audits.bytecode-alliance.audits.digest]]
591597
who = "Benjamin Bouvier <public@benj.me>"
592598
criteria = "safe-to-deploy"
@@ -862,6 +868,12 @@ who = "Pat Hickey <phickey@fastly.com>"
862868
criteria = "safe-to-deploy"
863869
version = "0.1.0"
864870

871+
[[audits.bytecode-alliance.audits.pem-rfc7468]]
872+
who = "Chris Fallin <chris@cfallin.org>"
873+
criteria = "safe-to-deploy"
874+
version = "0.7.0"
875+
notes = "Only `unsafe` around a `from_utf8_unchecked`, and no IO."
876+
865877
[[audits.bytecode-alliance.audits.percent-encoding]]
866878
who = "Alex Crichton <alex@alexcrichton.com>"
867879
criteria = "safe-to-deploy"
@@ -883,6 +895,26 @@ who = "Pat Hickey <phickey@fastly.com>"
883895
criteria = "safe-to-deploy"
884896
version = "0.1.0"
885897

898+
[[audits.bytecode-alliance.audits.pkg-config]]
899+
who = "Pat Hickey <phickey@fastly.com>"
900+
criteria = "safe-to-deploy"
901+
version = "0.3.25"
902+
notes = "This crate shells out to the pkg-config executable, but it appears to sanitize inputs reasonably."
903+
904+
[[audits.bytecode-alliance.audits.pkg-config]]
905+
who = "Alex Crichton <alex@alexcrichton.com>"
906+
criteria = "safe-to-deploy"
907+
delta = "0.3.26 -> 0.3.29"
908+
notes = """
909+
No `unsafe` additions or anything outside of the purview of the crate in this
910+
change.
911+
"""
912+
913+
[[audits.bytecode-alliance.audits.pkg-config]]
914+
who = "Chris Fallin <chris@cfallin.org>"
915+
criteria = "safe-to-deploy"
916+
delta = "0.3.29 -> 0.3.32"
917+
886918
[[audits.bytecode-alliance.audits.raw-cpuid]]
887919
who = "Alex Crichton <alex@alexcrichton.com>"
888920
criteria = "safe-to-deploy"
@@ -1013,6 +1045,12 @@ criteria = "safe-to-deploy"
10131045
version = "0.2.4"
10141046
notes = "Implements a concurrency primitive with atomics, and is not obviously incorrect"
10151047

1048+
[[audits.bytecode-alliance.audits.utf-8]]
1049+
who = "Chris Fallin <chris@cfallin.org>"
1050+
criteria = "safe-to-deploy"
1051+
version = "0.7.6"
1052+
notes = "Small library that uses `unsafe` only around `str::from_utf8_unchecked` after explicitly verifying UTF-8."
1053+
10161054
[[audits.bytecode-alliance.audits.vcpkg]]
10171055
who = "Pat Hickey <phickey@fastly.com>"
10181056
criteria = "safe-to-deploy"
@@ -2847,6 +2885,12 @@ side-effectful std functions, etc.
28472885
"""
28482886
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
28492887

2888+
[[audits.mozilla.audits.oneshot]]
2889+
who = "Bastian Gruber <foreach@me.com>"
2890+
criteria = "safe-to-deploy"
2891+
version = "0.1.11"
2892+
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
2893+
28502894
[[audits.mozilla.audits.percent-encoding]]
28512895
who = "Valentin Gosu <valentin.gosu@gmail.com>"
28522896
criteria = "safe-to-deploy"
@@ -2869,6 +2913,12 @@ Only functional change is to work around a bug in the negative_impls feature
28692913
"""
28702914
aggregated-from = "https://raw.githubusercontent.com/mozilla/cargo-vet/main/supply-chain/audits.toml"
28712915

2916+
[[audits.mozilla.audits.pkg-config]]
2917+
who = "Mike Hommey <mh+mozilla@glandium.org>"
2918+
criteria = "safe-to-deploy"
2919+
delta = "0.3.25 -> 0.3.26"
2920+
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
2921+
28722922
[[audits.mozilla.audits.powerfmt]]
28732923
who = "Alex Franchuk <afranchuk@mozilla.com>"
28742924
criteria = "safe-to-deploy"

0 commit comments

Comments
 (0)