From 136a175bc4e7159997575f81744f5bd5e9ab1cff Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 25 Sep 2026 22:42:39 +0000 Subject: [PATCH 1/2] chore(deps): bump device-driver from 2.1.0 to 2.1.1 Bumps [device-driver](https://github.com/diondokter/device-driver) from 2.1.0 to 2.1.1. - [Release notes](https://github.com/diondokter/device-driver/releases) - [Changelog](https://github.com/diondokter/device-driver/blob/master/CHANGELOG.md) - [Commits](https://github.com/diondokter/device-driver/compare/v2.1.0...v2.1.1) --- updated-dependencies: - dependency-name: device-driver dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1436949..b19b426 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -121,9 +121,9 @@ checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" [[package]] name = "device-driver" -version = "2.1.0" +version = "2.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2503fa8477e63231b485f927f7e578cf05de86ab8a883f6d7b401d8adcd169c4" +checksum = "c38a909a99943e2348df3f1ec63c9bf4ad84aa2f38484db17be88ec067d7344b" [[package]] name = "embedded-hal" From 25a157926adf7175ec708d8f02de2e7344d8c3f0 Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Mon, 28 Sep 2026 06:02:00 -0700 Subject: [PATCH 2/2] chore: certify device-driver 2.1.1 for safe-to-deploy The runtime crate's src/ is byte-identical to 2.1.0, so the existing 1.0.9 -> 2.1.0 audit carries forward unchanged. Everything in the 2.1.1 release notes lands in device-driver-generation, which this tree does not pull in. The remaining delta is packaging: the version bump, the pinned optional device-driver-macros dep, and a new test target. Unblocks the dependabot bump in #74. Assisted-by: opencode:claude-opus-5 --- supply-chain/audits.toml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 6452b3f..c9eac4e 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -35,6 +35,38 @@ proc-macro and embedded-io subtree that v1 pulled in is gone. Assisted-by: opencode:claude-opus-5 """ +[[audits.device-driver]] +who = "Felipe Balbi " +criteria = "safe-to-deploy" +delta = "2.1.0 -> 2.1.1" +notes = """ +No-op for the runtime crate. `src/` is byte-identical between the two +published packages, so every conclusion in the 1.0.9 -> 2.1.0 audit carries +forward unchanged: no build script (`build = false` still holds), the sole +powerful import is still the rustdoc `include_str!(concat!("../", +env!("CARGO_PKG_README")))` in lib.rs, and the unsafe surface (the lsb0 +bit-packing helpers in ops.rs and `unsafe trait Fieldset` in fieldset.rs) is +untouched. + +The three fixes in the 2.1.1 release notes -- the `defmt::Format` derives on +generated devices and blocks, the MIR-pass speedup with its identifier `Hash` +and `PartialEq` corrections, and the inclusive-vs-exclusive range fix for +repeated fields -- all land in `device-driver-generation`, not here. tmp108 +depends on device-driver with `default-features = false` and enables neither +`macros` nor `defmt`, so none of that code is in our dependency graph; +`cargo tree -e normal -p device-driver` still shows it with zero transitive +dependencies. + +What is left in the delta is packaging only: the version bump itself, the +pinned optional `device-driver-macros` dep moving `=2.1.0 -> =2.1.1` (not +enabled here), a new `[[test]]` target plus its `tests/repeats.rs` regression +test for the repeated-field fix, and the removal of the explicit +`readme = "README.md"` key from the workspace-side Cargo.toml. That last one +is cosmetic: the packaged manifest cargo publishes still carries +`readme = "README.md"`, so `CARGO_PKG_README` resolves as before. Test code +is not compiled into the library and adds no capability to a consumer. +""" + [[audits.device-driver-generation]] who = "Jerry Xie " criteria = "safe-to-deploy"