Update audits

supply-chain/config.toml

@@ -338,10 +338,6 @@ criteria = "safe-to-deploy"
 version = "0.10.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.half]]
-version = "1.8.2"
-criteria = "safe-to-run"
-
 [[exemptions.hermit-abi]]
 version = "0.1.19"
 criteria = "safe-to-deploy"
@@ -738,10 +734,6 @@ criteria = "safe-to-deploy"
 version = "1.0.137"
 criteria = "safe-to-deploy"
 
-[[exemptions.serde_cbor]]
-version = "0.11.2"
-criteria = "safe-to-run"
-
 [[exemptions.serde_derive]]
 version = "1.0.137"
 criteria = "safe-to-deploy"

supply-chain/imports.lock

@@ -169,6 +169,16 @@ who = "Mike Hommey <[email protected]>"
 criteria = "safe-to-deploy"
 delta = "0.2.6 -> 0.2.7"
 
+[[audits.mozilla.audits.half]]
+who = "John M. Schanck <[email protected]>"
+criteria = "safe-to-deploy"
+version = "1.8.2"
+notes = """
+This crate contains unsafe code for bitwise casts to/from binary16 floating-point
+format. I've reviewed these and found no issues. There are no uses of ambient
+capabilities.
+"""
+
 [[audits.mozilla.audits.hashbrown]]
 who = "Mike Hommey <[email protected]>"
 criteria = "safe-to-deploy"
@@ -288,6 +298,16 @@ who = "Mike Hommey <[email protected]>"
 criteria = "safe-to-deploy"
 delta = "1.0.143 -> 1.0.144"
 
+[[audits.mozilla.audits.serde_cbor]]
+who = "R. Martinho Fernandes <[email protected]>"
+criteria = "safe-to-deploy"
+version = "0.11.1"
+
+[[audits.mozilla.audits.serde_cbor]]
+who = "John M. Schanck <[email protected]>"
+criteria = "safe-to-deploy"
+delta = "0.11.1 -> 0.11.2"
+
 [[audits.mozilla.audits.serde_derive]]
 who = "Mike Hommey <[email protected]>"
 criteria = "safe-to-deploy"