diff --git a/gfx/wgpu_bindings/moz.yaml b/gfx/wgpu_bindings/moz.yaml
--- a/gfx/wgpu_bindings/moz.yaml
+++ b/gfx/wgpu_bindings/moz.yaml
@@ -18,15 +18,15 @@
   # Usually different from repository url
   url: https://github.com/gfx-rs/wgpu
 
   # Human-readable identifier for this version/release
   # Generally "version NNN", "tag SSS", "bookmark SSS"
-  release: commit b370b990
+  release: c6ca2a7d0d4859e641a8ed544ba3b376ad581060 (2022-08-14T01:25:49Z).
 
   # Revision to pull in
   # Must be a long or short commit SHA (long preferred)
-  revision: b370b990e543bd8c74c895a0f856604368806e5c
+  revision: c6ca2a7d0d4859e641a8ed544ba3b376ad581060
 
   license: ['MIT', 'Apache-2.0']
 
 updatebot:
     maintainer-phab: jimb
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -442,16 +442,10 @@
 Mozilla at the beginning of February 2022. This audit statement was
 collected by Jim Blandy, a Mozilla employee, over email in July 2022:
 Dzmitry was shown, and agreed to, the 'safe-to-deploy' text.
 """
 
-[[audits.xmldecl]]
-who = "Henri Sivonen <hsivonen@hsivonen.fi>"
-criteria = "safe-to-deploy"
-version = "0.2.0"
-notes = "I, Henri Sivonen, wrote this crate myself for Gecko even though it's published on crates.io."
-
 [[audits.wgpu-hal]]
 who = "Dzmitry Malyshau <kvark@fastmail.com>"
 criteria = "safe-to-deploy"
 version = "0.12.0"
 notes = """
@@ -472,5 +466,11 @@
 Mozilla at the beginning of February 2022. This audit statement was
 collected by Jim Blandy, a Mozilla employee, over email in July 2022:
 Dzmitry was shown, and agreed to, the 'safe-to-deploy' text.
 """
 
+[[audits.xmldecl]]
+who = "Henri Sivonen <hsivonen@hsivonen.fi>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+notes = "I, Henri Sivonen, wrote this crate myself for Gecko even though it's published on crates.io."
+