android/supply-chain/imports.lock - toolchain/cargo-deny - Git at Google


 # cargo-vet imports lock

 [[audits.google.audits.autocfg]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.1.0"
 notes = """
 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
 and there were no hits except for reasonable, client-controlled usage of
 `std::fs` in `AutoCfg::with_dir`.

 This crate has been added to Chromium in
 https://source.chromium.org/chromium/chromium/src/+/591a0f30c5eac93b6a3d981c2714ffa4db28dbcb
 The CL description contains a link to a Google-internal document with audit details.
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.bitflags]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "2.4.2"
 notes = """
 Audit notes:

 * I've checked for any discussion in Google-internal cl/546819168 (where audit
   of version 2.3.3 happened)
 * `src/lib.rs` contains `#![cfg_attr(not(test), forbid(unsafe_code))]`
 * There are 2 cases of `unsafe` in `src/external.rs` but they seem to be
   correct in a straightforward way - they just propagate the marker trait's
   impl (e.g. `impl bytemuck::Pod`) from the inner to the outer type
 * Additional discussion and/or notes may be found in https://crrev.com/c/5238056
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.bitflags]]
 who = "Adrian Taylor <[email protected]>"
 criteria = "safe-to-deploy"
 delta = "2.4.2 -> 2.5.0"
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.cfg-if]]
 who = "George Burgess IV <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.0"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

 [[audits.google.audits.equivalent]]
 who = "George Burgess IV <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.1"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

 [[audits.google.audits.heck]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "0.4.1"
 notes = """
 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
 and there were no hits.

 `heck` (version `0.3.3`) has been added to Chromium in
 https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.httpdate]]
 who = "George Burgess IV <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.3"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

 [[audits.google.audits.itoa]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.10"
 notes = '''
 I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.

 There are a few places where `unsafe` is used.  Unsafe review notes can be found
 in https://crrev.com/c/5350697.

 Version 1.0.1 of this crate has been added to Chromium in
 https://crrev.com/c/3321896.
 '''
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.lazy_static]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.4.0"
 notes = '''
 I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.

 There are two places where `unsafe` is used.  Unsafe review notes can be found
 in https://crrev.com/c/5347418.

 This crate has been added to Chromium in https://crrev.com/c/3321895.
 '''
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.pin-project-lite]]
 who = "David Koloski <[email protected]>"
 criteria = "safe-to-deploy"
 version = "0.2.9"
 notes = "Reviewed on https://fxrev.dev/824504"
 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.pin-project-lite]]
 who = "David Koloski <[email protected]>"
 criteria = "safe-to-deploy"
 delta = "0.2.9 -> 0.2.13"
 notes = "Audited at https://fxrev.dev/946396"
 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.proc-macro2]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.78"
 notes = """
 Grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
 (except for a benign \"fs\" hit in a doc comment)

 Notes from the `unsafe` review can be found in https://crrev.com/c/5385745.
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.proc-macro2]]
 who = "Adrian Taylor <[email protected]>"
 criteria = "safe-to-deploy"
 delta = "1.0.78 -> 1.0.79"
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.quote]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.35"
 notes = """
 Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
 (except for benign \"net\" hit in tests and \"fs\" hit in README.md)
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.rustversion]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.14"
 notes = """
 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
 and there were no hits except for:

 * Using trivially-safe `unsafe` in test code:

     ```
     tests/test_const.rs:unsafe fn _unsafe() {}
     tests/test_const.rs:const _UNSAFE: () = unsafe { _unsafe() };
     ```

 * Using `unsafe` in a string:

     ```
     src/constfn.rs:            \"unsafe\" => Qualifiers::Unsafe,
     ```

 * Using `std::fs` in `build/build.rs` to write `${OUT_DIR}/version.expr`
   which is later read back via `include!` used in `src/lib.rs`.

 Version `1.0.6` of this crate has been added to Chromium in
 https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.serde]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.197"
 notes = """
 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`.

 There were some hits for `net`, but they were related to serialization and
 not actually opening any connections or anything like that.

 There were 2 hits of `unsafe` when grepping:
 * In `fn as_str` in `impl Buf`
 * In `fn serialize` in `impl Serialize for net::Ipv4Addr`

 Unsafe review comments can be found in https://crrev.com/c/5350573/2 (this
 review also covered `serde_json_lenient`).

 Version 1.0.130 of the crate has been added to Chromium in
 https://crrev.com/c/3265545.  The CL description contains a link to a
 (Google-internal, sorry) document with a mini security review.
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.serde_derive]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.197"
 notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits"
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.shell-words]]
 who = "George Burgess IV <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.1.0"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

 [[audits.google.audits.static_assertions]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.1.0"
 notes = """
 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
 and there were no hits except for one `unsafe`.

 The lambda where `unsafe` is used is never invoked (e.g. the `unsafe` code
 never runs) and is only introduced for some compile-time checks.  Additional
 unsafe review comments can be found in https://crrev.com/c/5353376.

 This crate has been added to Chromium in https://crrev.com/c/3736562.  The CL
 description contains a link to a document with an additional security review.
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.tinyvec]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.6.0"
 notes = """
 Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
 and there were no hits except for some \"unsafe\" appearing in comments:

 ```
 src/arrayvec.rs:    // Note: This shouldn't use A::CAPACITY, because unsafe code can't rely on
 src/lib.rs://! All of this is done with no `unsafe` code within the crate. Technically the
 src/lib.rs://! `Vec` type from the standard library uses `unsafe` internally, but *this
 src/lib.rs://! crate* introduces no new `unsafe` code into your project.
 src/array.rs:/// Just a reminder: this trait is 100% safe, which means that `unsafe` code
 ```

 This crate has been added to Chromium in
 https://source.chromium.org/chromium/chromium/src/+/24773c33e1b7a1b5069b9399fd034375995f290b
 """
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.unicode-ident]]
 who = "Lukasz Anforowicz <[email protected]>"
 criteria = "safe-to-deploy"
 version = "1.0.12"
 notes = '''
 I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.

 All two functions from the public API of this crate use `unsafe` to avoid bound
 checks for an array access.  Cross-module analysis shows that the offsets can
 be statically proven to be within array bounds.  More details can be found in
 the unsafe review CL at https://crrev.com/c/5350386.

 This crate has been added to Chromium in https://crrev.com/c/3891618.
 '''
 aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.utf8parse]]
 who = "David Koloski <[email protected]>"
 criteria = "safe-to-deploy"
 version = "0.2.1"
 notes = "Reviewed on https://fxrev.dev/904811"
 aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

 [[audits.google.audits.version_check]]
 who = "George Burgess IV <[email protected]>"
 criteria = "safe-to-deploy"
 version = "0.9.4"
 aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

	# cargo-vet imports lock

	[[audits.google.audits.autocfg]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.1.0"
	notes = """
	Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
	and there were no hits except for reasonable, client-controlled usage of
	`std::fs` in `AutoCfg::with_dir`.

	This crate has been added to Chromium in
	https://source.chromium.org/chromium/chromium/src/+/591a0f30c5eac93b6a3d981c2714ffa4db28dbcb
	The CL description contains a link to a Google-internal document with audit details.
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.bitflags]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "2.4.2"
	notes = """
	Audit notes:

	* I've checked for any discussion in Google-internal cl/546819168 (where audit
	of version 2.3.3 happened)
	* `src/lib.rs` contains `#![cfg_attr(not(test), forbid(unsafe_code))]`
	* There are 2 cases of `unsafe` in `src/external.rs` but they seem to be
	correct in a straightforward way - they just propagate the marker trait's
	impl (e.g. `impl bytemuck::Pod`) from the inner to the outer type
	* Additional discussion and/or notes may be found in https://crrev.com/c/5238056
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.bitflags]]
	who = "Adrian Taylor <[email protected]>"
	criteria = "safe-to-deploy"
	delta = "2.4.2 -> 2.5.0"
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.cfg-if]]
	who = "George Burgess IV <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.0"
	aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

	[[audits.google.audits.equivalent]]
	who = "George Burgess IV <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.1"
	aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

	[[audits.google.audits.heck]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "0.4.1"
	notes = """
	Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
	and there were no hits.

	`heck` (version `0.3.3`) has been added to Chromium in
	https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.httpdate]]
	who = "George Burgess IV <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.3"
	aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

	[[audits.google.audits.itoa]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.10"
	notes = '''
	I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.

	There are a few places where `unsafe` is used. Unsafe review notes can be found
	in https://crrev.com/c/5350697.

	Version 1.0.1 of this crate has been added to Chromium in
	https://crrev.com/c/3321896.
	'''
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.lazy_static]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.4.0"
	notes = '''
	I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.

	There are two places where `unsafe` is used. Unsafe review notes can be found
	in https://crrev.com/c/5347418.

	This crate has been added to Chromium in https://crrev.com/c/3321895.
	'''
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.pin-project-lite]]
	who = "David Koloski <[email protected]>"
	criteria = "safe-to-deploy"
	version = "0.2.9"
	notes = "Reviewed on https://fxrev.dev/824504"
	aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.pin-project-lite]]
	who = "David Koloski <[email protected]>"
	criteria = "safe-to-deploy"
	delta = "0.2.9 -> 0.2.13"
	notes = "Audited at https://fxrev.dev/946396"
	aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.proc-macro2]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.78"
	notes = """
	Grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
	(except for a benign \"fs\" hit in a doc comment)

	Notes from the `unsafe` review can be found in https://crrev.com/c/5385745.
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.proc-macro2]]
	who = "Adrian Taylor <[email protected]>"
	criteria = "safe-to-deploy"
	delta = "1.0.78 -> 1.0.79"
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.quote]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.35"
	notes = """
	Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
	(except for benign \"net\" hit in tests and \"fs\" hit in README.md)
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.rustversion]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.14"
	notes = """
	Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
	and there were no hits except for:

	* Using trivially-safe `unsafe` in test code:

	```
	tests/test_const.rs:unsafe fn _unsafe() {}
	tests/test_const.rs:const _UNSAFE: () = unsafe { _unsafe() };
	```

	* Using `unsafe` in a string:

	```
	src/constfn.rs: \"unsafe\" => Qualifiers::Unsafe,
	```

	* Using `std::fs` in `build/build.rs` to write `${OUT_DIR}/version.expr`
	which is later read back via `include!` used in `src/lib.rs`.

	Version `1.0.6` of this crate has been added to Chromium in
	https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.serde]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.197"
	notes = """
	Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`.

	There were some hits for `net`, but they were related to serialization and
	not actually opening any connections or anything like that.

	There were 2 hits of `unsafe` when grepping:
	* In `fn as_str` in `impl Buf`
	* In `fn serialize` in `impl Serialize for net::Ipv4Addr`

	Unsafe review comments can be found in https://crrev.com/c/5350573/2 (this
	review also covered `serde_json_lenient`).

	Version 1.0.130 of the crate has been added to Chromium in
	https://crrev.com/c/3265545. The CL description contains a link to a
	(Google-internal, sorry) document with a mini security review.
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.serde_derive]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.197"
	notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits"
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.shell-words]]
	who = "George Burgess IV <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.1.0"
	aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"

	[[audits.google.audits.static_assertions]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.1.0"
	notes = """
	Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
	and there were no hits except for one `unsafe`.

	The lambda where `unsafe` is used is never invoked (e.g. the `unsafe` code
	never runs) and is only introduced for some compile-time checks. Additional
	unsafe review comments can be found in https://crrev.com/c/5353376.

	This crate has been added to Chromium in https://crrev.com/c/3736562. The CL
	description contains a link to a document with an additional security review.
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.tinyvec]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.6.0"
	notes = """
	Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
	and there were no hits except for some \"unsafe\" appearing in comments:

	```
	src/arrayvec.rs: // Note: This shouldn't use A::CAPACITY, because unsafe code can't rely on
	src/lib.rs://! All of this is done with no `unsafe` code within the crate. Technically the
	src/lib.rs://! `Vec` type from the standard library uses `unsafe` internally, but *this
	src/lib.rs://! crate* introduces no new `unsafe` code into your project.
	src/array.rs:/// Just a reminder: this trait is 100% safe, which means that `unsafe` code
	```

	This crate has been added to Chromium in
	https://source.chromium.org/chromium/chromium/src/+/24773c33e1b7a1b5069b9399fd034375995f290b
	"""
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.unicode-ident]]
	who = "Lukasz Anforowicz <[email protected]>"
	criteria = "safe-to-deploy"
	version = "1.0.12"
	notes = '''
	I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.

	All two functions from the public API of this crate use `unsafe` to avoid bound
	checks for an array access. Cross-module analysis shows that the offsets can
	be statically proven to be within array bounds. More details can be found in
	the unsafe review CL at https://crrev.com/c/5350386.

	This crate has been added to Chromium in https://crrev.com/c/3891618.
	'''
	aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.utf8parse]]
	who = "David Koloski <[email protected]>"
	criteria = "safe-to-deploy"
	version = "0.2.1"
	notes = "Reviewed on https://fxrev.dev/904811"
	aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"

	[[audits.google.audits.version_check]]
	who = "George Burgess IV <[email protected]>"
	criteria = "safe-to-deploy"
	version = "0.9.4"
	aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"