fix(fsevent): stop the run loop via a CFRunLoopSource to avoid a shutdown race

.github/SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+This document describes how to report security vulnerabilities in the crates maintained in this
+repository.
+
+## Supported Versions
+
+Security fixes are provided for:
+
+- The `main` branch.
+- The latest released versions of crates published from this repository.
+
+Older versions may not receive security backports. If you are using an older release, please plan to
+upgrade to a supported version to receive fixes.
+
+## Reporting a Vulnerability
+
+Please **do not** report security issues via public GitHub issues, pull requests, Discord, or other
+public channels.
+
+Instead, use GitHub's private vulnerability reporting:
+
+1. Go to this repository's **Security** tab.
+2. Click **Report a vulnerability** or create a **New draft security advisory**.
+
+Include as much of the following as you can:
+
+- Affected crate(s) and version(s), and whether you are using crates.io releases or git revisions.
+- Impact and severity assessment.
+- Reproduction steps and a minimal proof of concept.
+- Any relevant configuration details.
+
+If you're not sure whether something is a security issue, report it anyway and mark it as uncertain.
+
+### Notes about AI/LLM
+
+Fully AI-generated, low-quality, or spammy reports are not accepted. Reports must reflect a
+real investigation, include repository-specific details, and provide a credible reproduction or
+impact assessment. Sending AI slop or repeatedly submitting low-quality reports may result in a
+ban from the organization.
+
+## Disclosure Process
+
+After receiving a report, maintainers will make a best effort to:
+
+- Triage and assess impact, then work on a fix.
+- Coordinate a release and publish an advisory when a fix is available.
+
+Please keep vulnerability details confidential until an advisory is published, or maintainers confirm
+it is safe to disclose.

.github/workflows/ci.yml

@@ -11,16 +11,38 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
 
+permissions:
+  contents: read
+
 jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          advanced-security: false
+          annotations: true
+          version: v1.24.1
+
   # Code quality checks
   quality:
     name: Quality Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Check formatting
         run: cargo fmt --all -- --check
@@ -29,23 +51,23 @@ jobs:
         run: cargo clippy --all-targets --all-features -- -D warnings
 
       - name: Install typos-cli
-        uses: taiki-e/install-action@288875dd3d64326724fa6d9593062d9f8ba0b131 # v2.67.30
+        uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2.75.28
         with:
           tool: typos-cli
 
       - name: Check for typos
         run: typos
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@288875dd3d64326724fa6d9593062d9f8ba0b131 # v2.67.30
+        uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2.75.28
         with:
           tool: cargo-deny
 
       - name: Run cargo-deny
         run: cargo deny check
 
       - name: Install cargo-machete
-        uses: taiki-e/install-action@288875dd3d64326724fa6d9593062d9f8ba0b131 # v2.67.30
+        uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2.75.28
         with:
           tool: cargo-machete
 
@@ -61,7 +83,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        rust: [stable, nightly, 1.85]
+        rust: [stable, nightly, 1.88]
         include:
           # MacOS with fsevent
           - os: macos-latest
@@ -71,7 +93,7 @@ jobs:
             rust: nightly
             features: "--no-default-features --features macos_fsevent"
           - os: macos-latest
-            rust: 1.85
+            rust: 1.88
             features: "--no-default-features --features macos_fsevent"
           # MacOS with kqueue
           - os: macos-latest
@@ -81,11 +103,13 @@ jobs:
             rust: nightly
             features: "--no-default-features --features macos_kqueue"
           - os: macos-latest
-            rust: 1.85
+            rust: 1.88
             features: "--no-default-features --features macos_kqueue"
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Remove rust-toolchain.toml (Unix)
         if: runner.os != 'Windows'
@@ -99,51 +123,86 @@ jobs:
           }
 
       - name: Install Rust ${{ matrix.rust }}
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ matrix.rust }}
+        run: |
+          rustup override set ${{ matrix.rust }}
+          rustup update ${{ matrix.rust }}
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Build
-        run: cargo build --verbose
+        run: cargo build --verbose ${{ matrix.features }}
 
       - name: Build examples
-        run: cargo build --examples --verbose
+        run: cargo build --examples --verbose ${{ matrix.features }}
 
       - name: Run tests
-        run: cargo test --verbose
+        run: cargo test --workspace --exclude examples --verbose ${{ matrix.features }}
 
       - name: Run tests with futures
         if: matrix.rust == 'stable'
-        run: cargo test --verbose --features futures
+        run: cargo test --workspace --exclude examples --verbose ${{ matrix.features }} --features futures
 
       - name: Run tests with tokio
         if: matrix.rust == 'stable'
-        run: cargo test --verbose --features tokio
+        run: cargo test --workspace --exclude examples --verbose ${{ matrix.features }} --features tokio
+
+  # FreeBSD
+  freebsd:
+    name: FreeBSD - ${{ matrix.rust }}
+    runs-on: ubuntu-latest
+    needs: quality
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [stable, nightly, 1.88]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Test in FreeBSD VM
+        uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8
+        with:
+          release: "14.3"
+          envs: "CARGO_TERM_COLOR RUST_BACKTRACE"
+          usesh: true
+          prepare: |
+            pkg install -y curl
+          run: |
+            rm -f rust-toolchain.toml
+            curl https://sh.rustup.rs -sSf | sh -s -- -y --profile=minimal --default-toolchain ${{ matrix.rust }}
+            . $HOME/.cargo/env
+            cargo --version
+            rustc --version
+            cargo build --verbose
+            cargo build --examples --verbose
+            cargo test --verbose
 
   # Android cross-compilation
   android:
     name: Android
     runs-on: ubuntu-latest
     needs: quality
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Remove rust-toolchain.toml
         run: rm -f rust-toolchain.toml
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: armv7-linux-androideabi, aarch64-linux-android
+        run: |
+          rustup override set stable
+          rustup update stable
+          rustup target add armv7-linux-androideabi aarch64-linux-android
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Install cargo-ndk
-        uses: taiki-e/install-action@288875dd3d64326724fa6d9593062d9f8ba0b131 # v2.67.30
+        uses: taiki-e/install-action@51cd0b8c0499559d9a4d75c0f5c67bec3a894ec8 # v2.75.28
         with:
           tool: cargo-ndk
 
@@ -165,9 +224,10 @@ jobs:
   #       run: rm -f rust-toolchain.toml
 
   #     - name: Install Rust
-  #       uses: dtolnay/rust-toolchain@nightly
-  #       with:
-  #         targets: wasm32-wasip2
+  #       run: |
+  #       rustup override set stable
+  #       rustup update stable
+  #       rustup target wasm32-wasip2
 
   #     - name: Cache dependencies
   #       uses: Swatinem/rust-cache@v2