diff --git a/.config/taplo.toml b/.config/taplo.toml index 3070d61a..df10f77f 100644 --- a/.config/taplo.toml +++ b/.config/taplo.toml @@ -6,8 +6,8 @@ exclude = [ "**/testing/**", "**/zombienet/**", "**/zombienet_tests/**", - "target/**", ".cargo/**", + "target/**", ] # global rules diff --git a/.github/scripts/check-workspace.py b/.github/scripts/check-workspace.py index b43c8b75..14f78402 100644 --- a/.github/scripts/check-workspace.py +++ b/.github/scripts/check-workspace.py @@ -66,6 +66,8 @@ def get_crates(workspace_dir, exclude_crates) -> dict: for root, _dirs, files in os.walk(workspace_dir): if "target" in root: continue + if ".cargo" in os.path.relpath(root, workspace_dir).split(os.sep): + continue for file in files: if file != "Cargo.toml": continue diff --git a/deny.toml b/deny.toml index ef7c109e..f6532faf 100644 --- a/deny.toml +++ b/deny.toml @@ -3,9 +3,9 @@ [graph] targets = [ - { triple = "wasm32-unknown-unknown" }, - { triple = "x86_64-unknown-linux-gnu" }, - { triple = "x86_64-unknown-linux-musl" }, + { triple = "wasm32-unknown-unknown" }, + { triple = "x86_64-unknown-linux-gnu" }, + { triple = "x86_64-unknown-linux-musl" }, ] # all-features prevents krates 0.20+ from panicking with "unable to locate std" # on workspace crates that have a std feature but don't enable it by default. @@ -20,36 +20,36 @@ yanked = "warn" # Track via quarterly review instead of blocking CI. unmaintained = "none" ignore = [ - # ── wasmtime ────────────────────────────────────────────────────────────── - # Fix requires wasmtime 42.0.2+ → cranelift-assembler-x64 0.129+ → rustc 1.91.0+ - # Toolchain pinned to 1.88.0. Unblock when toolchain upgrades. - # We do NOT use Winch backend, Component Model, or 64-bit tables; - # most CVEs below only affect those code paths. - "RUSTSEC-2026-0006", # wasmtime: segfault with f64.copysign on x86-64 - "RUSTSEC-2026-0020", # wasmtime: WASI guest-controlled resource exhaustion - "RUSTSEC-2026-0021", # wasmtime: panic in wasi:http/types.fields - "RUSTSEC-2026-0085", # wasmtime: panic lifting flags component value - "RUSTSEC-2026-0086", # wasmtime: host data leakage 64-bit tables + Winch - "RUSTSEC-2026-0087", # wasmtime: segfault f64x2.splat on Cranelift x86-64 - "RUSTSEC-2026-0088", # wasmtime: data leakage pooling allocator instances - "RUSTSEC-2026-0089", # wasmtime: host panic table.fill with Winch - "RUSTSEC-2026-0091", # wasmtime: OOB write transcoding component model strings - "RUSTSEC-2026-0092", # wasmtime: panic transcoding misaligned UTF-16 strings - "RUSTSEC-2026-0093", # wasmtime: heap OOB read UTF-16 to latin1+utf16 - "RUSTSEC-2026-0094", # wasmtime: masked return value table.grow Winch - "RUSTSEC-2026-0095", # wasmtime: Winch sandbox-escaping memory access - "RUSTSEC-2026-0096", # wasmtime: miscompiled guest heap aarch64 Cranelift + # ── wasmtime ────────────────────────────────────────────────────────────── + # Fix requires wasmtime 42.0.2+ → cranelift-assembler-x64 0.129+ → rustc 1.91.0+ + # Toolchain pinned to 1.88.0. Unblock when toolchain upgrades. + # We do NOT use Winch backend, Component Model, or 64-bit tables; + # most CVEs below only affect those code paths. + "RUSTSEC-2026-0006", # wasmtime: segfault with f64.copysign on x86-64 + "RUSTSEC-2026-0020", # wasmtime: WASI guest-controlled resource exhaustion + "RUSTSEC-2026-0021", # wasmtime: panic in wasi:http/types.fields + "RUSTSEC-2026-0085", # wasmtime: panic lifting flags component value + "RUSTSEC-2026-0086", # wasmtime: host data leakage 64-bit tables + Winch + "RUSTSEC-2026-0087", # wasmtime: segfault f64x2.splat on Cranelift x86-64 + "RUSTSEC-2026-0088", # wasmtime: data leakage pooling allocator instances + "RUSTSEC-2026-0089", # wasmtime: host panic table.fill with Winch + "RUSTSEC-2026-0091", # wasmtime: OOB write transcoding component model strings + "RUSTSEC-2026-0092", # wasmtime: panic transcoding misaligned UTF-16 strings + "RUSTSEC-2026-0093", # wasmtime: heap OOB read UTF-16 to latin1+utf16 + "RUSTSEC-2026-0094", # wasmtime: masked return value table.grow Winch + "RUSTSEC-2026-0095", # wasmtime: Winch sandbox-escaping memory access + "RUSTSEC-2026-0096", # wasmtime: miscompiled guest heap aarch64 Cranelift - # ── rand 0.9.2 ──────────────────────────────────────────────────────────── - # Unsound only when a custom Rust logger calls rand::rng() during init. - # No custom logger in our stack. No fixed version available yet. - "RUSTSEC-2026-0097", # rand: unsound with custom logger using rand::rng() + # ── rand 0.9.2 ──────────────────────────────────────────────────────────── + # Unsound only when a custom Rust logger calls rand::rng() during init. + # No custom logger in our stack. No fixed version available yet. + "RUSTSEC-2026-0097", # rand: unsound with custom logger using rand::rng() - # ── webpki ──────────────────────────────────────────────────────────────── - # Name-constraints validation bugs in transitive webpki dep. - # We do not rely on certificate name constraints in our P2P/RPC stack. - "RUSTSEC-2026-0098", # webpki: URI name constraints incorrectly accepted - "RUSTSEC-2026-0099", # webpki: wildcard name constraints incorrectly accepted + # ── webpki ──────────────────────────────────────────────────────────────── + # Name-constraints validation bugs in transitive webpki dep. + # We do not rely on certificate name constraints in our P2P/RPC stack. + "RUSTSEC-2026-0098", # webpki: URI name constraints incorrectly accepted + "RUSTSEC-2026-0099", # webpki: wildcard name constraints incorrectly accepted ] # License compliance @@ -58,31 +58,31 @@ ignore = [ [licenses] confidence-threshold = 0.8 allow = [ - "Apache-2.0 WITH LLVM-exception", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "BSL-1.0", - "CC0-1.0", - "CDLA-Permissive-2.0", - "GPL-3.0-only WITH Classpath-exception-2.0", - "GPL-3.0-only", - "GPL-3.0-or-later WITH Classpath-exception-2.0", - "GPL-3.0-or-later", - "ISC", - "MIT", - "MIT-0", - "MPL-2.0", - "NCSA", - "OpenSSL", - "Unicode-3.0", - "Unicode-DFS-2016", - "Unlicense", - "Zlib", + "Apache-2.0 WITH LLVM-exception", + "Apache-2.0", + "BSD-2-Clause", + "BSD-3-Clause", + "BSL-1.0", + "CC0-1.0", + "CDLA-Permissive-2.0", + "GPL-3.0-only WITH Classpath-exception-2.0", + "GPL-3.0-only", + "GPL-3.0-or-later WITH Classpath-exception-2.0", + "GPL-3.0-or-later", + "ISC", + "MIT", + "MIT-0", + "MPL-2.0", + "NCSA", + "OpenSSL", + "Unicode-3.0", + "Unicode-DFS-2016", + "Unlicense", + "Zlib", ] exceptions = [ - # ring uses a custom ISC-style license - { allow = ["OpenSSL"], name = "ring" }, + # ring uses a custom ISC-style license + { allow = ["OpenSSL"], name = "ring" }, ] [licenses.private] @@ -103,6 +103,6 @@ unknown-registry = "warn" unknown-git = "warn" allow-registry = ["https://github.com/rust-lang/crates.io-index"] allow-git = [ - # Our serde fork with wasm32v1-none target fix (pending upstream merge) - "https://github.com/pezkuwichain/serde.git", + # Our serde fork with wasm32v1-none target fix (pending upstream merge) + "https://github.com/pezkuwichain/serde.git", ]