mirrors/arti.git/maint, branch arti-v1.9.0mirror of https://gitlab.torproject.org/tpo/core/arti
http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v1.9.02026-01-12T12:32:35Zcargo: Update `arti-*` and `tor-*` to `0.38.0`2026-01-12T12:32:35ZClara Englercve@cve.cx2026-01-12T12:32:35Zurn:sha1:230b0201ea730a633e55c2781611a52c5ec73c28
Done using the following:
```bash
for crate in $(./maint/list_crates | rg '^(tor|arti-)'); do
cargo set-version -p $crate 0.38.0
done
```
maint: Ignore RUSTSEC-2025-01412026-01-12T10:28:44ZClara Englercve@cve.cx2026-01-12T10:28:44Zurn:sha1:c0835c8cdead7125f33fed85dca740a99249bf8b
Bincode is unmaintained. Right now, we do not depend on it directly,
but rather transitively through maybenot (with tor-proto) and
typed-index-collections (with tor-netdoc).
This has been reported upstream in the respective crates:
* <https://github.com/zheland/typed-index-collections/issues/10>
* <https://github.com/maybenot-io/maybenot/issues/40>
It is pretty unfortunate, but there is not much we can do at the current
moment, given that it is an external matter and we need it for the next
arti release; also, as far as I am aware, there are no known security
vulnerabilities in the current version of bincode.
Therefore, this commit adds it to the list of exception.
Fixes #2311
See #2312
check_licenses: Adjust comment on priority-queue exception2025-12-09T10:27:27ZGabriela Moldovangabi@torproject.org2025-12-08T16:18:40Zurn:sha1:0f549dc639118c2547b96c90cad00b98b88ebba5
Technically `priority-queue` belongs in the `MPL_20_OK` list, but our
current checks are too rudimentary to be able to handle the `OR` (we
*do* split on `OR` for one of the checks, but we only compare the
resulting licenses against `RECOGNIZED_LICENSES`, not `MPL_20_OK`). So
for now, let's retain the exception for `priority-queue`.
(We could expand the logic in the branch handling the `OR'`d licenses to
fix this issue, but the result would be quite fragile; and besides, I
think we're going to eventually want to replace this with a proper
license parser).
check_licenses: Update comment about priority-queue2025-12-09T10:27:27ZGabriela Moldovangabi@torproject.org2025-12-01T11:29:06Zurn:sha1:996b669e42be3b9cbab8ea7176bfa55472b3eb77
They have in fact added the MPL "Exhibit A" text to every file in the
crate.
The license is still LGPL-3.0-or-later OR MPL-2.0, so the rest of the
comment still applies.
See
https://github.com/garro95/priority-queue/pull/54/commits/e2f90b0811c252f80165bbdb19233464289e428f
maint: rework 'extract-md-links' interposition2025-12-08T17:50:39ZSteven Engleropara@torproject.org2025-12-03T21:48:29Zurn:sha1:076a5ccf86b6076d9f35367d71b1efba6a6f3ed6
Do less parsing, and instead interpose the mistune internals.
maint: add comment to 'extract-md-links' re manual parsing2025-12-08T17:50:39ZSteven Engleropara@torproject.org2025-12-03T18:09:42Zurn:sha1:9a32c4ae4f1246bd3a331fd2cb72030ab12c89f1maint: add a self-test to 'extract-md-links'2025-12-08T17:50:39ZSteven Engleropara@torproject.org2025-12-02T01:49:52Zurn:sha1:c92dbacbc5edf5d5c5f0383c186b76c5f388d5f6maint: fix 'extract-md-links' to work with mistune 3.1.32025-12-08T17:50:39ZSteven Engleropara@torproject.org2025-12-02T00:01:41Zurn:sha1:3b08770826a181eee15a39bd91d154bae53412edmaint: fix accidental globals in 'extract-md-links'2025-12-08T17:50:39ZSteven Engleropara@torproject.org2025-12-02T03:08:32Zurn:sha1:44f0cfbe5852ed03559bbb6b020223b2ae610c17maint: fix method names for 'extract-md-links' parsers2025-12-08T17:50:39ZSteven Engleropara@torproject.org2025-12-01T23:43:49Zurn:sha1:b55906f72d015439d7109f21e6a322fde11a92a5
`InlineParser::parse_link` isn't publicly documented, so may be subject
to more breakage.