This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate assets_manager

Dependencies

(26 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 ab_glyph^0.2.120.2.31up to date
 assets_manager_macros^0.3.10.3.1up to date
 base64^0.220.22.1up to date
 bincode^22.0.1up to date
 crc32fast^1.4.21.5.0up to date
 crossbeam-channel^0.50.5.15up to date
 flate2^1.11.1.2up to date
 foldhash^0.2.00.2.0up to date
 gltf^1.01.4.1up to date
 hashbrown ⚠️>=0.15, <0.170.16.0maybe insecure
 image^0.250.25.8up to date
 log^0.40.4.28up to date
 memmap2^0.9.40.9.8up to date
 notify^8.08.2.0up to date
 once_cell^1.161.21.3up to date
 parking_lot^0.120.12.4up to date
 rmp-serde^1.11.3.0up to date
 ron^0.110.11.0up to date
 serde^1.01.0.219up to date
 serde_json^1.01.0.143up to date
 serde_yaml^0.9.10.9.34+deprecatedup to date
 sync_file^0.30.3.1up to date
 tar^0.4.380.4.44up to date
 toml^0.9.10.9.5up to date
 zip^45.1.0out of date
 zstd^0.13.30.13.3up to date

Dev dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 cfg-if^1.01.0.3up to date
 env_logger^0.110.11.8up to date
 rand^0.90.9.2up to date
 serde^1.01.0.219up to date

Security Vulnerabilities

hashbrown: Borsh serialization of HashMap is non-canonical

RUSTSEC-2024-0402

The borsh serialization of the HashMap did not follow the borsh specification. It potentially produced non-canonical encodings dependent on insertion order. It also did not perform canonicty checks on decoding.

This can result in consensus splits and cause equivalent objects to be considered distinct.

This was patched in 0.15.1.