Skip to content

chore(supply-chain): bump json5 exemption to 1.3.6 - #1360

Merged
BryanFRD merged 1 commit into
mainfrom
fix/vet-json5
Oct 31, 2026
Merged

BryanFRD merged 1 commit into
mainfrom
fix/vet-json5

Conversation

@BryanFRD

Copy link
Copy Markdown
Contributor

#1359 moved json5 to 1.3.6 without updating the exemption, so cargo vet has failed on main since.

I read the 1.3.4 to 1.3.6 crate diff: parse_number inlines a helper, and the tests change. No new dependency, unsafe code or I/O. cargo vet passes locally.

Signed-off-by: BryanFRD <bryanferrando59@gmail.com>

@ferrfleet-interne ferrfleet-interne Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approve: the json5 exemption now matches the 1.3.6 in Cargo.lock. No findings.

@ferrfleet-interne

Copy link
Copy Markdown
Contributor

Ready to merge. The review found no issues. Formal verification did not run, so there is no result from it.

Review: supply-chain/config.toml changes the json5 cargo-vet exemption from 1.3.4 to 1.3.6. That matches the json5 version in Cargo.lock at the PR head. No findings.

Formal verification: the run failed and returned no result. Nothing is claimed either way. A one-line exemption bump has no code properties to check, so this probably doesn't matter here.

@BryanFRD
BryanFRD enabled auto-merge (squash) October 31, 2026 09:40
@BryanFRD
BryanFRD merged commit dfd63ec into main Oct 31, 2026
32 checks passed
@BryanFRD
BryanFRD deleted the fix/vet-json5 branch October 31, 2026 09:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant