# cargo-vet audits file

[[wildcard-audits.prio]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
user-id = 101233
start = "2020-09-28"
end = "2024-03-23"
renew = false

[[wildcard-audits.prio]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
user-id = 213776
start = "2020-09-28"
end = "2026-01-07"
renew = false

[[wildcard-audits.prio]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
trusted-publisher = "github:divviup/libprio-rs"
start = "2025-11-03"
end = "2027-02-09"

[[audits.aes]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.8.2 -> 0.8.3"

[[audits.aes]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.8.3 -> 0.8.4"
notes = """
Change affects some unsafe code. The only functional change is to add an
assertion checking alignment and to change an `as *mut u32` cast to a
call to `std::pointer::cast`.
"""

[[audits.aes-gcm]]
who = "Tim Geoghegan <timg@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.10.1 -> 0.10.2"

[[audits.alga]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.9.3"

[[audits.alloca]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.4.0"

[[audits.anstyle]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
version = "1.0.0"

[[audits.assert_matches]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "1.5.0"

[[audits.az]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.2.1 -> 1.3.0"

[[audits.base64]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.20.0 -> 0.21.0"

[[audits.base64]]
who = "Tim Geoghegan <timg@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.21.0 -> 0.21.1"

[[audits.base64]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.21.1 -> 0.21.2"

[[audits.base64]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.21.2 -> 0.21.3"

[[audits.base64]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-run"
delta = "0.21.3 -> 0.21.4"

[[audits.base64]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.21.4 -> 0.21.5"

[[audits.base64]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.21.5 -> 0.21.6"
notes = "sourcegraph-based diff did not see the v0.21.6 tag; I retrieved a local copy of the repo and used that for diff'ing."

[[audits.base64]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.21.6 -> 0.21.7"

[[audits.base64]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.21.7 -> 0.22.0"

[[audits.base64]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.22.0 -> 0.22.1"

[[audits.block-buffer]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.9.0"

[[audits.cc]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "1.2.41 -> 1.2.48"

[[audits.cfg-if]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.0 -> 1.0.1"

[[audits.cfg-if]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.1 -> 1.0.3"

[[audits.cfg-if]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.3 -> 1.0.4"

[[audits.ciborium-io]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.2.0"

[[audits.clap]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "4.1.14 -> 4.3.0"

[[audits.clap_builder]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "4.1.14 -> 4.3.0"

[[audits.clap_lex]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.4.1 -> 0.5.0"

[[audits.cmac]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.7.1"

[[audits.cmac]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.7.1 -> 0.7.2"

[[audits.criterion]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.4.0 -> 0.5.1"

[[audits.criterion]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-run"
delta = "0.5.1 -> 0.6.0"
notes = "No new unsafe code and nothing suspicious in build scripts."

[[audits.criterion]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.6.0 -> 0.7.0"

[[audits.criterion]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.7.0 -> 0.8.0"

[[audits.criterion]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-run"
delta = "0.8.0 -> 0.8.1"

[[audits.criterion]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-run"
delta = "0.8.1 -> 0.8.2"

[[audits.criterion-plot]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-run"
version = "0.8.1"

[[audits.criterion-plot]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.5.0 -> 0.6.0"

[[audits.criterion-plot]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.6.0 -> 0.7.0"

[[audits.criterion-plot]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.7.0 -> 0.8.0"

[[audits.criterion-plot]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-run"
delta = "0.8.1 -> 0.8.2"

[[audits.crunchy]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.2.2"

[[audits.dbl]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.3.2"

[[audits.digest]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.10.6 -> 0.10.7"

[[audits.either]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "1.6.1"

[[audits.errno-dragonfly]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
version = "0.1.2"

[[audits.fiat-crypto]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.1.17"
notes = """
This crate does not contain any unsafe code, and does not use any items from
the standard library or other crates, aside from operations backed by
`std::ops`. All paths with array indexing use integer literals for indexes, so
there are no panics due to indexes out of bounds (as rustc would catch an
out-of-bounds literal index). I did not check whether arithmetic overflows
could cause a panic, and I am relying on the Coq code having satisfied the
necessary preconditions to ensure panics due to overflows are unreachable.
"""

[[audits.fiat-crypto]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.1.17 -> 0.1.18"

[[audits.fiat-crypto]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.1.18 -> 0.1.19"
notes = """
This release renames many items and adds a new module. The code in the new
module is entirely composed of arithmetic and array accesses.
"""

[[audits.fiat-crypto]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.1.19 -> 0.1.20"

[[audits.fiat-crypto]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.1.20 -> 0.2.0"

[[audits.fiat-crypto]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.0 -> 0.2.1"

[[audits.fiat-crypto]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.1 -> 0.2.2"
notes = "No changes to `unsafe` code, or any functional changes that I can detect at all."

[[audits.fiat-crypto]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.2 -> 0.2.4"

[[audits.fiat-crypto]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.4 -> 0.2.5"

[[audits.fiat-crypto]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.5 -> 0.2.6"

[[audits.fiat-crypto]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.6 -> 0.2.7"

[[audits.fiat-crypto]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.7 -> 0.2.8"

[[audits.fiat-crypto]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.8 -> 0.2.9"
notes = "No changes to Rust code between 0.2.8 and 0.2.9"

[[audits.fiat-crypto]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.9 -> 0.3.0"
notes = "The diff is huge, but that's because it introduces a wrapper around indexing into arrays which is used in many many places. There is no new unsafe code and no change to build scripts I can detect."

[[audits.find-msvc-tools]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.1.4 -> 0.1.5"

[[audits.fixed]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.20.0 -> 1.21.0"

[[audits.fixed]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.21.0 -> 1.22.1"

[[audits.fixed]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.22.1 -> 1.23.0"

[[audits.fixed]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.23.0 -> 1.23.1"

[[audits.fixed]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.23.1 -> 1.25.0"

[[audits.fixed]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.25.0 -> 1.25.1"

[[audits.fixed]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.25.1 -> 1.26.0"

[[audits.fixed]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.26.0 -> 1.27.0"

[[audits.fixed]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.27.0 -> 1.29.0"
notes = """
There is some new `unsafe` code but it does reasonable things like
unchecked arithmetic.
"""

[[audits.fixed]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.29.0 -> 1.30.0"

[[audits.fixed-macro]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "1.2.0"

[[audits.fixed-macro-impl]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "1.2.0"

[[audits.generic-array]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.14.6 -> 0.13.3"

[[audits.getrandom]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.2.2 -> 0.1.16"

[[audits.getrandom]]
who = "Tim Geoghegan <timg@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.2.9 -> 0.2.10"
notes = "These changes include some new `unsafe` code for the `emscripten` and `psvita` targets, but all it does is call `libc::getentropy`."

[[audits.getrandom]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.10 -> 0.2.11"

[[audits.getrandom]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.11 -> 0.2.12"

[[audits.getrandom]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.12 -> 0.2.14"

[[audits.getrandom]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.14 -> 0.2.15"

[[audits.getrandom]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.3.1 -> 0.3.2"

[[audits.ghash]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.5.0"

[[audits.hermit-abi]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.2.6 -> 0.3.1"

[[audits.hex-literal]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.3.4"

[[audits.hex-literal]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.4.0"

[[audits.hex-literal]]
who = "Tim Geoghegan <timg@letsencrypt.org>"
criteria = "safe-to-run"
delta = "0.4.0 -> 0.4.1"

[[audits.hmac]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.12.1"

[[audits.io-lifetimes]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "1.0.10 -> 1.0.11"

[[audits.itertools]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.10.5 -> 0.11.0"

[[audits.itertools]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-run"
delta = "0.14.0 -> 0.13.0"
notes = "This *downgrade* only removes `unsafe` code."

[[audits.keccak]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.1.2"

[[audits.keccak]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.1.2 -> 0.1.3"

[[audits.keccak]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.1.3 -> 0.1.4"

[[audits.libbz2-rs-sys]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
version = "0.1.1"
notes = """
libbz2-rs-sys mainly uses unsafe around the C FFI boundary, for libc interop,
and for custom allocation support. Most end-user-facing decompression logic
is in safe Rust. I have fuzzed and reviewed its code, and to the best of my
ability I believe it's free of any serious security vulnerabilities.

libbz2-rs-sys only depends on the libc crate, which is widely used and
maintained by the Rust project.
"""

[[audits.libc]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.139 -> 0.2.141"

[[audits.libc]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.2.149 -> 0.2.150"

[[audits.libz-rs-sys]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
version = "0.4.0"
notes = """
This crate uses unsafe since it's for C to Rust FFI. I have reviewed and fuzzed it, and I believe it is free of any serious security problems.

The only dependency is zlib-rs, which is maintained by the same maintainers as this crate.
"""

[[audits.libz-rs-sys]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.4.0 -> 0.4.1"

[[audits.libz-rs-sys]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.4.1 -> 0.4.2"

[[audits.libz-rs-sys]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.4.2 -> 0.5.0"

[[audits.libz-rs-sys]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.5.0 -> 0.5.1"

[[audits.libz-rs-sys]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.5.1 -> 0.5.2"

[[audits.linux-raw-sys]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.3.3 -> 0.3.8"

[[audits.modinverse]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.1.1"

[[audits.nalgebra]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.29.0 -> 0.32.6"

[[audits.nalgebra]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.32.6 -> 0.33.0"

[[audits.nalgebra]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.33.0 -> 0.33.1"

[[audits.nalgebra]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.33.1 -> 0.33.2"

[[audits.nalgebra-macros]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.1.0 -> 0.2.2"

[[audits.num-bigint]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.4.3 -> 0.4.4"

[[audits.num-integer]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.1.45 -> 0.1.46"

[[audits.num-iter]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.1.43 -> 0.1.44"

[[audits.num-iter]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.1.44 -> 0.1.45"

[[audits.num-rational]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.4.1 -> 0.4.2"

[[audits.num-traits]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.15 -> 0.2.16"

[[audits.num-traits]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.16 -> 0.2.17"

[[audits.num-traits]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.17 -> 0.2.18"

[[audits.num-traits]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.2.18 -> 0.2.19"

[[audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.14.0 -> 1.15.0"

[[audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.15.0 -> 1.16.0"
notes = """
Changes to unsafe code in src/lib.rs, src/impl_std.rs, and src/imp_pl.rs are
functionally equivalent, and call unwrap_unchecked() on already-initialized
Options. The new implementation based on critical_section appears to be sound.
"""

[[audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.16.0 -> 1.17.0"

[[audits.once_cell]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.17.1 -> 1.17.2"

[[audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.17.2 -> 1.18.0"

[[audits.once_cell]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.18.0 -> 1.19.0"

[[audits.once_cell]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.19.0 -> 1.20.1"

[[audits.once_cell]]
who = "J.C. Jones <jc@insufficient.coffee>"
criteria = "safe-to-deploy"
delta = "1.20.3 -> 1.21.0"

[[audits.once_cell]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-run"
delta = "1.21.0 -> 1.21.1"

[[audits.once_cell]]
who = "J.C. Jones <jc@insufficient.coffee>"
criteria = "safe-to-deploy"
delta = "1.21.1 -> 1.21.3"
notes = "The unsafe code has moved from `compare_exchange` to a new `init` function, which makes it easier to reason about."

[[audits.opaque-debug]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.3.0"

[[audits.page_size]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.6.0"

[[audits.prio]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.16.8"

[[audits.proc-macro-error-attr]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "1.0.4"

[[audits.proc-macro2]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.49 -> 1.0.47"

[[audits.proc-macro2]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.52 -> 1.0.54"

[[audits.rand]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.8.5 -> 0.9.1"

[[audits.rand]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.9.1 -> 0.9.2"

[[audits.rand_chacha]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.3.1"

[[audits.rand_chacha]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.3.0 -> 0.2.2"

[[audits.rand_chacha]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.3.1 -> 0.9.0"

[[audits.rand_core]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.6.3"

[[audits.rand_core]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.6.1 -> 0.5.1"

[[audits.rand_core]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.6.4 -> 0.9.3"

[[audits.rand_core]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.9.3 -> 0.9.5"

[[audits.rand_distr]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.4.3 -> 0.5.1"

[[audits.rand_hc]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.2.0"

[[audits.rawpointer]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.2.1"

[[audits.rayon]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.6.1 -> 1.7.0"

[[audits.rayon]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.7.0 -> 1.8.0"

[[audits.rayon]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.8.0 -> 1.8.1"

[[audits.rayon]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.8.1 -> 1.9.0"

[[audits.rayon]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.9.0 -> 1.10.0"

[[audits.rayon]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.10.0 -> 1.11.0"
notes = """
I compared src/slice/sort.rs against the file library/core/src/slice/sort.rs
from the standard library, as of commit e501add.
"""

[[audits.rayon-core]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
version = "1.12.1"

[[audits.rayon-core]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.10.2 -> 1.11.0"

[[audits.rayon-core]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.10.2 -> 1.11.0"

[[audits.rayon-core]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.11.0 -> 1.12.0"

[[audits.rayon-core]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.12.1 -> 1.13.0"

[[audits.serde]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.152 -> 1.0.153"

[[audits.serde]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.153 -> 1.0.154"

[[audits.serde]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.154 -> 1.0.155"

[[audits.serde]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.156 -> 1.0.159"

[[audits.serde]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.160 -> 1.0.162"

[[audits.serde]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.162 -> 1.0.163"

[[audits.serde]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.203 -> 1.0.204"

[[audits.serde]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.204 -> 1.0.207"

[[audits.serde]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.219 -> 1.0.224"

[[audits.serde]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.224 -> 1.0.225"

[[audits.serde]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.225 -> 1.0.226"

[[audits.serde_core]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
version = "1.0.224"

[[audits.serde_core]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.224 -> 1.0.225"

[[audits.serde_core]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.225 -> 1.0.226"

[[audits.serde_derive]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.152 -> 1.0.153"

[[audits.serde_derive]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.153 -> 1.0.154"

[[audits.serde_derive]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.154 -> 1.0.155"

[[audits.serde_derive]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.156 -> 1.0.159"

[[audits.serde_derive]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.160 -> 1.0.162"

[[audits.serde_derive]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.162 -> 1.0.163"

[[audits.serde_derive]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.203 -> 1.0.204"

[[audits.serde_derive]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.204 -> 1.0.207"

[[audits.serde_derive]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.219 -> 1.0.224"

[[audits.serde_derive]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.224 -> 1.0.225"

[[audits.serde_derive]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.225 -> 1.0.226"

[[audits.serde_json]]
who = "Tim Geoghegan <timg@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "1.0.91 -> 1.0.92"
notes = "The only changes are to doccomments, a dev-dependency and the project's CI workflow, so there should be no risk to dependents."

[[audits.serde_json]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.92 -> 1.0.93"

[[audits.serde_json]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.93 -> 1.0.94"

[[audits.serde_json]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.94 -> 1.0.95"

[[audits.serde_json]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.140 -> 1.0.141"
notes = "There are three new `unsafe` blocks, but they are well-justified and appear safe by code inspection."

[[audits.serde_json]]
who = "J.C. Jones <jc@insufficient.coffee>"
criteria = "safe-to-deploy"
delta = "1.0.141 -> 1.0.142"

[[audits.serde_json]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.142 -> 1.0.143"

[[audits.serde_json]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.143 -> 1.0.145"

[[audits.sha2]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.10.2"

[[audits.sha2]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.10.8 -> 0.10.9"

[[audits.sha3]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.10.6"

[[audits.sha3]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.10.6 -> 0.10.7"

[[audits.sha3]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "0.10.7 -> 0.10.8"

[[audits.simba]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.6.0 -> 0.8.1"

[[audits.simba]]
who = "J.C. Jones <jc@insufficient.coffee>"
criteria = "safe-to-run"
delta = "0.8.1 -> 0.9.0"

[[audits.statest]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "0.2.2"

[[audits.statrs]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.16.0 -> 0.16.1"

[[audits.statrs]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-run"
delta = "0.16.1 -> 0.17.1"

[[audits.statrs]]
who = "J.C. Jones <jc@insufficient.coffee>"
criteria = "safe-to-run"
delta = "0.17.1 -> 0.18.0"
notes = "In particular, network access is limited to setup for the NIST tests (which are optional), and there are no new uses of unsafe."

[[audits.subtle]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "2.4.1 -> 2.5.0"

[[audits.subtle]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "2.5.0 -> 2.6.1"

[[audits.syn]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.104 -> 2.0.11"

[[audits.thiserror]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.38 -> 1.0.39"

[[audits.thiserror]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.39 -> 1.0.40"

[[audits.thiserror]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.40 -> 1.0.43"

[[audits.thiserror]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.63 -> 1.0.64"

[[audits.thiserror]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "2.0.17 -> 2.0.18"

[[audits.thiserror-impl]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.38 -> 1.0.39"

[[audits.thiserror-impl]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.39 -> 1.0.40"

[[audits.thiserror-impl]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.40 -> 1.0.43"

[[audits.thiserror-impl]]
who = "Brandon Pitman <bran@bran.land>"
criteria = "safe-to-deploy"
delta = "1.0.63 -> 1.0.64"

[[audits.thiserror-impl]]
who = "J.C. Jones <jc@divviup.org>"
criteria = "safe-to-deploy"
delta = "2.0.17 -> 2.0.18"

[[audits.unicode-ident]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "1.0.2 -> 1.0.3"

[[audits.universal-hash]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.4.1"

[[audits.universal-hash]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.5.0 -> 0.5.1"

[[audits.untrusted]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.7.1"

[[audits.wasi]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
delta = "0.10.0+wasi-snapshot-preview1 -> 0.9.0+wasi-snapshot-preview1"

[[audits.wasm-bindgen-shared]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "0.2.83"

[[audits.zipf]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-run"
version = "7.0.0"

[[audits.zipf]]
who = "David Cook <dcook@divviup.org>"
criteria = "safe-to-deploy"
version = "7.0.1"

[[audits.zipf]]
who = "Tim Geoghegan <timg@divviup.org>"
criteria = "safe-to-run"
delta = "7.0.0 -> 7.0.1"

[[audits.zlib-rs]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
version = "0.4.0"
notes = """
zlib-rs uses unsafe Rust for invoking compiler intrinsics (i.e. SIMD), eschewing bounds checks, along the FFI boundary, and for interacting with pointers sourced from C. I have extensively reviewed and fuzzed the unsafe code. All findings from that work have been resolved as of version 0.4.0. To the best of my ability, I believe it's free of any serious security problems.

zlib-rs does not require any external dependencies.
"""

[[audits.zlib-rs]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.4.0 -> 0.4.1"

[[audits.zlib-rs]]
who = "Ameer Ghani <inahga@divviup.org>"
criteria = "safe-to-deploy"
delta = "0.4.1 -> 0.4.2"

[[audits.zlib-rs]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.4.2 -> 0.5.0"

[[audits.zlib-rs]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.5.0 -> 0.5.1"

[[audits.zlib-rs]]
who = "Ameer Ghani <inahga@letsencrypt.org>"
criteria = "safe-to-deploy"
delta = "0.5.1 -> 0.5.2"

[[trusted.byteorder]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
start = "2019-06-09"
end = "2024-06-08"

[[trusted.cc]]
criteria = "safe-to-deploy"
user-id = 55123 # rust-lang-owner
start = "2022-10-29"
end = "2026-12-03"

[[trusted.clap]]
criteria = "safe-to-deploy"
user-id = 6743 # Ed Page (epage)
start = "2021-12-08"
end = "2026-05-22"

[[trusted.clap_builder]]
criteria = "safe-to-deploy"
user-id = 6743 # Ed Page (epage)
start = "2023-03-28"
end = "2026-05-22"

[[trusted.find-msvc-tools]]
criteria = "safe-to-deploy"
user-id = 539 # Josh Stone (cuviper)
start = "2025-08-29"
end = "2026-12-03"

[[trusted.itoa]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-05-02"
end = "2024-06-08"

[[trusted.js-sys]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2019-03-04"
end = "2024-06-08"

[[trusted.libc]]
criteria = "safe-to-deploy"
user-id = 2915 # Amanieu d'Antras (Amanieu)
start = "2021-01-27"
end = "2024-06-08"

[[trusted.libc]]
criteria = "safe-to-deploy"
user-id = 51017 # Yuki Okushi (JohnTitor)
start = "2020-03-17"
end = "2025-05-06"

[[trusted.libm]]
criteria = "safe-to-deploy"
user-id = 2915 # Amanieu d'Antras (Amanieu)
start = "2022-02-06"
end = "2024-07-13"

[[trusted.memchr]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
start = "2019-07-07"
end = "2024-06-08"

[[trusted.num-bigint]]
criteria = "safe-to-deploy"
user-id = 539 # Josh Stone (cuviper)
start = "2019-09-04"
end = "2025-05-15"

[[trusted.num-complex]]
criteria = "safe-to-run"
user-id = 539 # Josh Stone (cuviper)
start = "2019-06-10"
end = "2024-07-13"

[[trusted.num-rational]]
criteria = "safe-to-run"
user-id = 539 # Josh Stone (cuviper)
start = "2019-06-11"
end = "2024-07-13"

[[trusted.num_cpus]]
criteria = "safe-to-deploy"
user-id = 359
start = "2019-06-10"
end = "2024-06-08"

[[trusted.paste]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-03-19"
end = "2024-06-08"

[[trusted.proc-macro2]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-04-23"
end = "2024-07-03"

[[trusted.quote]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-04-09"
end = "2024-07-03"

[[trusted.regex]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
start = "2019-02-27"
end = "2024-06-08"

[[trusted.regex-syntax]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
start = "2019-03-30"
end = "2024-06-08"

[[trusted.rustix]]
criteria = "safe-to-run"
user-id = 6825
start = "2021-10-29"
end = "2024-11-21"

[[trusted.ryu]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-05-02"
end = "2024-06-08"

[[trusted.scopeguard]]
criteria = "safe-to-deploy"
user-id = 2915 # Amanieu d'Antras (Amanieu)
start = "2020-02-16"
end = "2024-06-08"

[[trusted.serde]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-03-01"
end = "2026-09-29"

[[trusted.serde_core]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2025-09-13"
end = "2026-09-29"

[[trusted.serde_derive]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-03-01"
end = "2026-09-29"

[[trusted.serde_json]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-02-28"
end = "2026-12-22"

[[trusted.syn]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-03-01"
end = "2025-11-04"

[[trusted.thiserror]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-10-09"
end = "2025-11-04"

[[trusted.thiserror-impl]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2019-10-09"
end = "2025-11-04"

[[trusted.thread_local]]
criteria = "safe-to-deploy"
user-id = 2915 # Amanieu d'Antras (Amanieu)
start = "2019-09-07"
end = "2024-06-08"

[[trusted.wasi]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2020-06-03"
end = "2024-06-08"

[[trusted.wasm-bindgen]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2019-03-04"
end = "2024-06-08"

[[trusted.wasm-bindgen-backend]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2019-03-04"
end = "2024-06-08"

[[trusted.wasm-bindgen-macro]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2019-03-04"
end = "2024-06-08"

[[trusted.wasm-bindgen-macro-support]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2019-03-04"
end = "2024-06-08"

[[trusted.web-sys]]
criteria = "safe-to-deploy"
user-id = 1 # Alex Crichton (alexcrichton)
start = "2019-03-04"
end = "2024-06-08"

[[trusted.winapi-util]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
start = "2020-01-11"
end = "2024-06-08"

[[trusted.windows-sys]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2021-11-15"
end = "2024-06-20"

[[trusted.windows-targets]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2022-09-09"
end = "2024-06-20"

[[trusted.windows_aarch64_gnullvm]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2022-09-01"
end = "2024-06-20"

[[trusted.windows_aarch64_msvc]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2021-11-05"
end = "2024-06-20"

[[trusted.windows_i686_gnu]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2021-10-28"
end = "2024-06-20"

[[trusted.windows_i686_msvc]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2021-10-27"
end = "2024-06-20"

[[trusted.windows_x86_64_gnu]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2021-10-28"
end = "2024-06-20"

[[trusted.windows_x86_64_gnullvm]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2022-09-01"
end = "2024-06-20"

[[trusted.windows_x86_64_msvc]]
criteria = "safe-to-deploy"
user-id = 64539
start = "2021-10-27"
end = "2024-06-20"

[[trusted.zmij]]
criteria = "safe-to-deploy"
user-id = 3618 # David Tolnay (dtolnay)
start = "2025-12-18"
end = "2027-02-02"