chore: Ignore cargo deny DoS errors in our outdated quick-xml - #24242
Merged
Merged
Conversation
Contributor
|
It was discussed when I added the second comment that once there were three they should probably be above each string in the array. |
Contributor
|
Also typo "Ingore" |
evilpie
force-pushed
the
cargo-deny
branch
2 times, most recently
from
July 17, 2026 20:14
4fc2733 to
a45427c
Compare
evilpie
changed the title
kjarosh
approved these changes
Jul 17, 2026
evilpie
enabled auto-merge (rebase)
July 17, 2026 20:22
Hancock33
added a commit
to Hancock33/batocera.piboy
that referenced
this pull request
Jul 28, 2026
-------------------------------------------------------------------------------------------------------- batocera-emulationstation.mk cb07f02d64c019cc8b8c9d506954d1f6e01af4e7 # Version: Commits on Jul 17, 2026 -------------------------------------------------------------------------------------------------------- update po Signed-off-by: Nicolas Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com>, ------------------------------------------------------------------------------------------------ batocera-es-piboy.mk cb07f02d64c019cc8b8c9d506954d1f6e01af4e7 # Version: Commits on Jul 17, 2026 ------------------------------------------------------------------------------------------------ update po Signed-off-by: Nicolas Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com>, ----------------------------------------------------------------------------------- cemu.mk 3005cb7b46e3b9c45644d4105ae3a984f87336fb # Version: Commits on Jul 18, 2026 ----------------------------------------------------------------------------------- coreinit: Implement a few more DynLoad functions (#1990), -------------------------------------------------------------------------------------------- hypseus-singe.mk 5c8434e4127b91646a34d5fdb155ff8d6b11be5f # Version: Commits on Jul 18, 2026 -------------------------------------------------------------------------------------------- Cleanup palette namespace, ------------------------------------------------------------------------------------ rpcs3.mk 0fcb15ab1810926ac0b3ffdbcc38ed01eadbf861 # Version: Commits on Jul 18, 2026 ------------------------------------------------------------------------------------ SPU: Revert 49abd6d8e56256a7d49fdc3fbd8c17efa6faf419, -------------------------------------------------------------------------------------- tsugaru.mk fb48b0af5fdd0401ca9e571017f3d75ba4c9b46a # Version: Commits on Jul 17, 2026 -------------------------------------------------------------------------------------- Fixing Linux build., ------------------------------------------------- vice.mk r46178 # Version: Commits on Jul 17, 2026 ------------------------------------------------- null --------------------------------------------------------------- ruffle.mk nightly-2026-07-18 # Version: Commits on Jul 18, 2026 --------------------------------------------------------------- ## What's Changed * frontend-utils: Don't use native certs for rustls backend of reqwest by @torokati44 in ruffle-rs/ruffle#24218 * Revert \chore: Bump wgpu to 28, switch egui to git\ by @danielhjacobs in ruffle-rs/ruffle#24234 * avm2: Properly display `global$init()` in stack traces by @kjarosh in ruffle-rs/ruffle#24238 * avm1: Remove stub from `Sound.setPosition()` to act as a no-op by @ChrisCPI in ruffle-rs/ruffle#24239 * avm2: Handle function objects in JSON.stringify by @evilpie in ruffle-rs/ruffle#24240 * chore: Ignore cargo deny DoS errors in our outdated quick-xml by @evilpie in ruffle-rs/ruffle#24242 * avm2: Check and throw correct error for Timer delay by @evilpie in ruffle-rs/ruffle#24241 * avm2: Use a shared cold path for no-arg error constructors by @kjarosh in ruffle-rs/ruffle#24233 * tests: Add avm1/selection_asbroadcaster by @kjarosh in ruffle-rs/ruffle#24245 **Full Changelog**: ruffle-rs/ruffle@nightly-2026-07-17...nightly-2026-07-18, --------------------------------------------------------------------------------------- thextech.mk 995bde4128e504a84e46dc334ffc3ba015b9441a # Version: Commits on Jul 17, 2026 --------------------------------------------------------------------------------------- Attempt to fix the MSVC build As it was done at the FreeType, try to disable the configuration types forwarding, --------------------------------------------------------------------------------------- alephone.mk 760c940e3c76122a007b28ddcc07c587e604f22a # Version: Commits on Jul 17, 2026 --------------------------------------------------------------------------------------- Update github actions and fix depreciations, ------------------------------------------------------------------------------------------ fallout2-ce.mk d8d99fe94a8497e150e569f1471424dc0148333a # Version: Commits on Jul 18, 2026 ------------------------------------------------------------------------------------------ Merge pull request #562 from fallout2-ce/deobfuscate_color_usage Deobfuscate color usage, ----------------------------------------------- d7vk.mk v2.0 # Version: Commits on Jul 18, 2026 ----------------------------------------------- _We've had one round of performance improvements, yes, but what about the second round of performance improvements?_, an inquisitive hobbit might ask. Well, that time is now, and it comes from partially unexpected sources. This release rounds up quite a few bug fixes and general performance boosts, and although it is mostly a symbolic version tag, it does quite literally come with a 2x(+) performance increase in some CPU limited scenarios, so it only seems fitting to bump the major versioning at this point. ## Further improvements to ProcessVertices The previously delayed improvements to ProcessVertices call handling have now landed, thanks to @CkNoSFeRaTU, who put in a lot of effort to devise handrolled SSE helpers for all our CPU intensive calculations. Together with some tweaks/workarounds in the area of buffer access and uploads in such scenarios, the improvements are quite noticeable in affected games*. | Half-Life - D7VK v1.12 | Half-Life - D7VK v2.0 | |-------|---------| | <img width=\640\ height=\480\ alt=\HL_12\ src=\https://github.com/user-attachments/assets/73269b19-47f2-4eaf-802e-5cd0e24695f5\ /> | <img width=\640\ height=\480\ alt=\HL_20\ src=\https://github.com/user-attachments/assets/3169b647-18b7-4b3a-b3e4-1cea5caabd9b\ /> | | Toy Story 2 - D7VK v1.12 | Toy Story 2 - D7VK v2.0 | |-------|---------| | <img width=\640\ height=\480\ alt=\Toy2_12\ src=\https://github.com/user-attachments/assets/000b7a76-29c3-4ae6-a3f9-b65f24b14b9e\ /> | <img width=\640\ height=\480\ alt=\Toy2_20\ src=\https://github.com/user-attachments/assets/c2d8cf59-13ed-4aa2-9d42-e593853180b1\ /> | \\*Note: _Half-Life is capped to 60 FPS by default, and Toy Story 2 has an enforced cap of 30 FPS, but both can easily exceed those numbers with v2.0 (not without hitting various engine issues/limitations however)._ ## Debug logging - there's no free lunch After the previous round of CPU bottleneck removal, dealing with wrapped surface lookups (see [the v1.12 release](https://github.com/WinterSnowfall/d7vk/releases#release-v1.12) for more details), and an interesting discussion with @CkNoSFeRaTU, I decided to see if our many debug loggers, which were plastered all over some very hot paths as well, actually had a measurable impact on performance. Mind you, these are loggers which weren't *shown/printed* normally, however did perform various string operations anyway, which isn't exactly free real estate. There's no better way to showcase the difference than with the usual benchmarks, and with _Unreal Tournament_, our go to uncapped D3D7 game, so basically a repeat of the benchmarks I ran for the v1.12 release: | 3DMark '99 Max - D7VK v1.12| 3DMark '99 Max - D7VK v2.0 | |-------|---------| | <img width=\506\ height=\321\ alt=\99_v112\ src=\https://github.com/user-attachments/assets/2ac59f99-a7ad-4e43-94d8-b0ed70519035\ /> | <img width=\506\ height=\321\ alt=\3DMark99_20\ src=\https://github.com/user-attachments/assets/2b75f216-28b3-4073-a9df-144c7d5d2f5b\ /> | | 3DMark 2000 - D7VK v1.12 | 3DMark 2000 - D7VK v2.0 | |-------|---------| | <img width=\506\ height=\373\ alt=\2000_v112\ src=\https://github.com/user-attachments/assets/2793a17a-2e82-4cda-82ae-09558372f43a\ /> | <img width=\506\ height=\373\ alt=\3DMark2000_20\ src=\https://github.com/user-attachments/assets/2be5b4f0-04c7-4491-99d1-e99e555d955a\ /> | | Unreal Tournament - D7VK v1.12 | Unreal Tournament - D7VK v2.0 | |-------|---------| | <img width=\640\ height=\480\ alt=\v112\ src=\https://github.com/user-attachments/assets/448a88c8-e935-4b4b-bf48-d59335f2fca5\ /> | <img width=\640\ height=\480\ alt=\v20\ src=\https://github.com/user-attachments/assets/19401814-979f-4f98-b532-eb979f263fc1\ /> | Mind you, the debug loggers in question have been trimmed down and kept away from the hot paths, but not entirely removed, because, well... we still need them for debugging. Though to a lesser degree now, since thanks to @CkNoSFeRaTU apitrace has been brought up to snuff for early D3D. As a result, most of the 3DMark individual benchmarks are now entirely GPU limited, which is a very good sign indeed. You might ask: _Benchmarks are nice and all, but what does that mean for VSync-limited games, which represent the majority of the early D3D population?_ Well, in truth not much really, only lower CPU usage, which is still a nice improvement when you consider the fact almost all these games are single-threaded and need the CPU cycles for things outside of rendering, such as game logic. Fixes/additions: - Rebased on top of the upstream **DXVK 3.0.2** release. - Improved the performance of CPU ProcessVertices calls with handrolled SSE helpers, and fixed a few minor regressions, thanks to @CkNoSFeRaTU. - Added a workaround for (D3D9) MANAGED pool buffer placement targeted at DEFAULT buffers, which *drastically* help with upload performance when said buffers are used for SWVP/ProcessVertices calls as well. This has had a positive effect on performance in _Toy Story 2: Buzz Lightyear to the Rescue_, _SCP - Containment Breach_ and practically all GoldSrc engine titles, such as _Half-Life_. - Stripped most debug loggers, and moved others away from hot paths, which apparently has had a drastic effect on performance in CPU limited scenarios. - Worked around a WineD3D limitation concerning video memory bump luminance format surfaces, which has fixed minor rendering issues in _Dungeon Keeper 2_ and the _Matrox G400 TechDemo_. - After a careful analysis of age accurate GPUs such as the Matrox G400, Nvidia Riva TNT2 and ATI Rage 128 on Windows XP, we're now reporting the POW2 and non-POW2 conditional surface dimension caps globally. This has fixed clipping issues in various games, such as _Empire Earth_ and removed the need for specific workarounds in _Total Annihilation: Kingdoms_, _Revenant_ and a few other titles. - Worked around broken projected light terrain Z-fighting on night tracks in _Need for Speed: Porsche_. Thanks to @CkNoSFeRaTU for helping out in determining the root cause of this game bug. - Addressed several oversights and potential problems in the D7VK codebase (thanks to @hourianto for spending their tokens on an LLM-driven review pass, which was *mostly* useful). - Create a HAL device in situations where a game passes an unknown GUID. This works around texture filtering issues in _Revenant_. - Simplify surface attachment handling thanks to an upstream WineD3D DDraw bug being fixed, which speeds up all surface Flip calls. - Fixed a black screen regression affecting _The Sims: Complete Collection_. - Added a frame limit for _Dungeon Keeper 2_, to prevent runaway flame/water surface animations. - Fixed a regression which caused some materials to be erroneously updated as if they were the currently set device material. - Finalized the removal of stipple caps from reported device features, also based on observed values reported by age-accurate video cards. - Only report `D3DPRASTERCAPS_ANTIALIASSORTINDEPENDENT` as a device FSAA capability, as per observed behavior of age-accurate video cards. That's it, enjoy! And sorry for gutting performance with excessive logging up until now, but those loggers were quite essential in the early development of D7VK, though their impact on performance was largely underestimated (so I was *extra* generous in sprinkling them everywhere 😅). Things are more streamlined now that they're retired and we'll thank them for their service. P.S.: Note that games running uncapped *will* now generally incur a higher GPU usage, since the CPU has more cycles at its disposal to drive rendering - it's a feature, not a bug., ------------------------------------------------- dxvk.mk v3.0.2 # Version: Commits on Jul 17, 2026 ------------------------------------------------- ## Hang debugging In case of a GPU hang or driver crash resulting in `VK_ERROR_DEVICE_LOST` errors, the environment variable `DXVK_DEBUG=hang` can now be used to help narrow down the crash location. Resulting log files may provide useful information in bug reports. This works best on AMD and Nvidia GPUs. See PR #5790 for details. ## Bug fixes and Improvements - Worked around a performance regression in games that create a new DXGI factory every single frame. This affects **Dying Light: The Beast** with FSR enabled, and potentially other D3D12 games. - **Granblue Fantasy Relink**: Fixed spurious GPU hangs on Nvidia, may affect other games. (#5785) - **Halo CE**: Worked around a game bug causing rendering issues. (PR #5783) - **Overwatch**: Fixed potential swapchain issue when running at non-native resolutions. (PR #5794) - **Splinter Cell: Chaos Theory**: Worked around a game bug that would cause night vision to misrender. (#5780), ---------------------------------------------------------------------------------------- retroarch.mk acdd5092881bbf94bcadbe6dfe6341e2a2e55b77 # Version: Commits on Jul 18, 2026 ---------------------------------------------------------------------------------------- rh264: support multiple reference pictures P slices that name more than one reference picture were refused outright, so almost nothing decoded past the key frame in practice: three reference frames is the x264 default even for baseline, and only the first inter picture of a clip ever names just one. rh264_video now holds a decoded picture buffer sized from the sequence parameter set instead of a single previous frame. It is kept most-recent-first, which is the order the default P list initialisation of 8.2.4.2.1 produces without list reordering, so reference index 0 names the newest picture. An IDR empties it, only pictures with nal_ref_idc set enter it, and the oldest is evicted once it is full (the sliding window of 8.2.5.3). ref_idx_l0 is now parsed: te(v) for CAVLC, a single inverted bit when two pictures are available and ue(v) beyond that; unary at ctxIdxOffset 54 for CABAC, with the first bin contexted on whether the left and above partitions use an index above zero. Both partition dispatchers were reordered so that every ref_idx precedes every mvd, as 7.3.5.1 and 7.3.5.2 require. The motion vector grid carries the real reference index, which feeds the predictor's refIdxN comparison and the deblocking test for differing references. Two faults that a single reference picture had been hiding came out with it. The motion vector predictor returned mvLXA whenever B and C were merely intra rather than genuinely absent; with one reference A always matched the current index, so the \exactly one neighbour matches\ rule of 8.4.1.3.1 returned A anyway and the shortcut was invisible. It is wrong once indices differ, because an intra neighbour contributes a zero vector to the median, and it is replaced by the rule 8.4.1.3 actually states: B and C inherit A's vector and index only when both are unavailable in the 6.4.11.7 sense. The CABAC ref_idx unary string was also truncated at the largest legal index, which skipped its terminating zero and desynchronised the arithmetic decoder. Slices using weighted prediction are refused, since pred_weight_table is not parsed and would otherwise desynchronise the slice header. x264 enables it by default outside baseline, so those clips keep animating across key frames as before rather than decoding to nonsense. Byte-exact against libopenh264 on sixty-two cases: nineteen single-reference clips, four CABAC clips, a constant-QP sweep, and baseline three-reference clips at 176x144 and 320x240, every frame, luma and both chroma. A sixty-frame three-reference clip goes from two decodable pictures to sixty., ---------------------------------------------------------------------------------------- doomretro.mk 8cc63cb51c9eeb88ed0fd4564c7acf369309c59b # Version: Commits on Jul 18, 2026 ---------------------------------------------------------------------------------------- Clear speciallumpname on `map` CCMD fail Causes weird behavior discussed in issue #958., -------------------------------------------------------------------------------------- vkquake.mk b808f9562a02a7daf8c95f25e01373d687f982ea # Version: Commits on Jul 18, 2026 -------------------------------------------------------------------------------------- Fix R_ClearBModelInstanceClaims race, -------------------------------------------------------------------------------------- yquake2.mk 732c7493491228c32c12bcfc30f1cdc11b68fd63 # Version: Commits on Jul 17, 2026 -------------------------------------------------------------------------------------- Merge commit '1b096249' Part of rebase: yquake2/yquake2#1339, ------------------------------------------------------------------------------------------------------- libretro-beetle-pce-fast.mk 9e6510023545007e235117753329946cbc5f311a # Version: Commits on Jul 18, 2026 ------------------------------------------------------------------------------------------------------- Avoid tvOS stack overflow in PCE Fast load path (#244), ---------------------------------------------------------------------------------------------- libretro-brimir.mk 85d4fb7a3e18448731aa83eb6775ee3bfaf6a02e # Version: Commits on Jul 18, 2026 ---------------------------------------------------------------------------------------------- fix(libretro): apply core options after disc load to keep region autodetection intact, -------------------------------------------------------------------------------------------------- libretro-gearcoleco.mk ee000a3d6f3af6b2125575d651c99936281715a4 # Version: Commits on Jul 18, 2026 -------------------------------------------------------------------------------------------------- Bump version to 1.6.7, ------------------------------------------------------------------------------------------------- libretro-geargrafx.mk c48cb8bc39ac51a0e66f4c0fc46627bd59d412df # Version: Commits on Jul 18, 2026 ------------------------------------------------------------------------------------------------- Bump version to 1.7.15, -------------------------------------------------------------------------------------------------- libretro-gearsystem.mk 9509f2f832c8d996687ec525366657c8a1a86b13 # Version: Commits on Jul 18, 2026 -------------------------------------------------------------------------------------------------- Bump version to 3.9.13, ---------------------------------------------------------------------------------------------------- libretro-parallel-n64.mk f39bc9b23f15c7e2e33200ebb4c0c449f51b5b69 # Version: Commits on Jul 18, 2026 ---------------------------------------------------------------------------------------------------- angrylion HLE: Naboo walker environment-mapped texture coordinates (overlay 0x2a) Triangle commands with w0 bit 11 compute their S/T pairs from vertex normals instead of inline words: the four index bytes ride the low byte of each would-be inline S/T word (+16/+20/+24/+28), and per index the normal (halfword elements 4-6 of the raw input record at 0x170) is transformed by the normal matrix at DMEM 0xe40 with the fourth row added as a translation, the integer lanes drop the bias pair at 0xf0 (u16 wrap, fractions untouched), the vector is normalized through the squares fold and the reciprocal square root scaled by the overlay's 0xab constant, and the S/T halfwords are the scale pair at 0xec times the normalized x/y. The results replace the inline pokes for all four corners (rejoin text 0xb10 plus the quad tail's lane-e12 store for D), command length 32 bytes. Verification: both compositor tasks remain word-identical (3,739 and 3,823 pairs); the Indiana Jones 3D task -- whose triangles are all frustum-rejected in this capture, leaving no stream evidence -- was driven past its color-overlay blocker with a validation-only bypass (NB_SKIP_COLOVL) and holds 46 of 48 record S/T words bit-exact against the oracle end state, the two exceptions being downstream of the deliberately skipped lighting. Stream-level proof awaits a capture whose environment-mapped triangles survive to emission, after the lighting overlays land. Live: Battle for Naboo completes eight more slices per run (the bit-11 commands that previously forced fallback), with the framebuffer and audio baselines exact; Indiana Jones and Gauntlet unchanged. Also recorded: the per-command [POKE] probe does not display the quad's fourth vertex, retracting the previous session's single-triangle-b4 concern -- the quad model was never in question., --------------------------------------------------------------------------------------------- libretro-pd777.mk 95c33b4ade962af1747014053bba01c2162629b3 # Version: Commits on Jul 17, 2026 --------------------------------------------------------------------------------------------- Fetch translations & Recreate libretro_core_options_intl.h, ---------------------------------------------------------------------------------------------- libretro-prboom.mk cf978dc91e9a7447fa2ce271795b0cc1592e5218 # Version: Commits on Jul 18, 2026 ---------------------------------------------------------------------------------------------- r_segs/r_main: make stacked-sector portals render on real content Two fixes found by walking a relocated camera through zdcmp2's 27 stacked pairings, each invisible on the synthetic test map: Flush window edges never received spans. The visplane merge identity now includes the portal id, but the classic markfloor/markceiling comparison still saw a window whose heights, pics and light match its neighbours -- which is how every real stacked window is built -- as a no-op boundary, so the neighbour plane took all the spans and the orphaned window plane never modified. The two-sided mark logic now forces the mark whenever the seg's two REAL sectors differ and either side is portaled (curline's sectors, because the frontsector/backsector globals may be R_FakeFlat rewrites). Gated on sector_portals_active: maps without pairings run the untouched comparison. The synthetic map could not catch this because its window was bounded by one-sided walls, which always mark. Portal windows vanished on any map with an active skybox. The composite scene renders (default and tagged skyboxes) call R_ClearPlanes for their own walk, and the portal pass collected its ids and spans from the visplane set AFTER those renders -- so on zdcmp2, whose GLDEFS skybox is active every frame, the collection always saw an empty set. The portal pass is now split like the tagged-skybox block already is: ids and spans are snapshotted right after the masked phase, before any composite render, and the translated-camera renders run after the skybox composites using the cached spans. With both fixes a real zdcmp2 stacked window composites translated room content where the previous build drew darkness (verified against the pre-portal build from a relocated player start; repeat runs byte-identical), and every identity check holds: the synthetic stacked map, the skybox map, both plain maps, and the zdcmp2 spawn are all pixel-identical to the previous build., --------------------------------------------------------------------------------------------- libretro-vba-m.mk acb67e8e56931b5d71d209a948891b490ef1e8c9 # Version: Commits on Jul 17, 2026 --------------------------------------------------------------------------------------------- Validate SGB packet counts A zero SGB packet count let a malformed cartridge continue past the seven-packet receive buffer, corrupting adjacent emulator state. Reject zero counts and reset invalid receiver states before a packet-buffer access can exceed its fixed capacity.,
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
I would argue that DoS problems aren't really that interesting for us, because there are probably tons of ways for bad Flash code to cause a DoS, so we might as well ignore it for now.
#21107 exists to update quick-xml
In fact, I think the permanently red CI might hide other more critical advisories in the future.
Testing
Checklist