From 42cb85fc67e9c33af9f167c8a2370fff22832dda Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Tue, 4 Aug 2026 18:14:36 -0700 Subject: [PATCH 1/2] fix(msrv): take state-history-forensic 0.1.1 so the declared floor holds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This crate declares an MSRV it cannot actually meet. The cause is one line in a transitive dependency: state-history-forensic 0.1.0 ships edition = "2024", and Cargo below 1.85 cannot parse such a manifest at all — feature `edition2024` is required ...not stabilized in this version of Cargo (1.75.0) That is a parse failure, not a compile failure, so it fires regardless of which part of the crate is used, and it reached every repo underneath it. state-history-forensic 0.1.1 is that same code with edition 2021 and a 1.75 floor — src/ is byte-identical to 0.1.0, so this is a resolution change and nothing more. It sits inside the existing "0.1" requirement, so only the lockfile moves. Verified on the real toolchain rather than by inspection: ufs-forensic, the strictest of the affected repos at 1.75, fails to parse before this and passes `cargo +1.75 check` after. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3f1965a..d95b845 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -488,9 +488,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" [[package]] name = "state-history-forensic" -version = "0.1.0" +version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "06d95f05c0dd49a5dfae0eb6cb6fae7bb3bd5c1f787300c94a3a5adecb44d98f" +checksum = "41b218f92b938038c4a8c7e38389e9751711d8cd9099991061e52bc274c398b6" [[package]] name = "syn" From 4ce042fd28de8be221c54f5917f53ef816406041 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Tue, 4 Aug 2026 18:28:31 -0700 Subject: [PATCH 2/2] fix(supply-chain): trust state-history-forensic as ours instead of exempting it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Publishing 0.1.1 turned cargo-vet red here: state-history-forensic:0.1.1 missing ["safe-to-deploy"] The record it had was a version-pinned exemption for 0.1.0. Exemptions are ADR-0018's mechanism (4), the weakest and the last resort — but this crate is ours, published to crates.io by h4x0r, which is mechanism (2), a trust entry. Taking the weaker mechanism where a stronger one applies is the defect; it also guarantees the recurrence, because an exemption names one version and so goes stale on every release we cut. `cargo vet trust state-history-forensic h4x0r` records the publisher rather than the version, so the next bump does not red this repo again. Verified by making it fail on purpose, not by reading the green: with the trust entry removed `cargo vet --locked` reports exactly the failure above, and with it restored the run succeeds. A vet pass that survives deleting its own justification would be evidence of nothing. --- supply-chain/audits.toml | 6 ++++++ supply-chain/config.toml | 4 ---- supply-chain/imports.lock | 7 +++++++ 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 2772ccb..749165e 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2,3 +2,9 @@ # cargo-vet audits file [audits] + +[[trusted.state-history-forensic]] +criteria = "safe-to-deploy" +user-id = 347968 # Albert Hui (h4x0r) +start = "2026-06-16" +end = "2027-08-05" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index e257112..a31a8f2 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -198,10 +198,6 @@ criteria = "safe-to-run" version = "0.4.12" criteria = "safe-to-deploy" -[[exemptions.state-history-forensic]] -version = "0.1.0" -criteria = "safe-to-deploy" - [[exemptions.syn]] version = "2.0.117" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index da7d0df..5af688e 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -8,6 +8,13 @@ user-id = 696 user-login = "fitzgen" user-name = "Nick Fitzgerald" +[[publisher.state-history-forensic]] +version = "0.1.1" +when = "2026-08-05" +user-id = 347968 +user-login = "h4x0r" +user-name = "Albert Hui" + [[audits.bytecode-alliance.wildcard-audits.bumpalo]] who = "Nick Fitzgerald " criteria = "safe-to-deploy"