This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
cargo(55 total, 13 outdated, 2 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| anyhow | ^1.0 | 1.0.82 | up to date |
| atty | ^0.2 | 0.2.14 | up to date |
| bytesize | ^1.0 | 1.3.0 | up to date |
| cargo-platform | ^0.1.2 | 0.1.8 | up to date |
| cargo-util | ^0.2.0 | 0.2.10 | up to date |
| clap | ^3.1.0 | 4.5.4 | out of date |
| crates-io | ^0.34.0 | 0.40.0 | out of date |
| crossbeam-utils | ^0.8 | 0.8.19 | up to date |
| curl | ^0.4.41 | 0.4.46 | up to date |
| curl-sys | ^0.4.50 | 0.4.72+curl-8.6.0 | up to date |
| env_logger | ^0.9.0 | 0.11.3 | out of date |
| filetime | ^0.2.9 | 0.2.23 | up to date |
| flate2 | ^1.0.3 | 1.0.28 | up to date |
| fwdansi | ^1.1.0 | 1.1.0 | up to date |
| git2 | ^0.14.2 | 0.18.3 | out of date |
| git2-curl | ^0.15.0 | 0.19.0 | out of date |
| glob | ^0.3.0 | 0.3.1 | up to date |
| hex | ^0.4 | 0.4.3 | up to date |
| home | ^0.5 | 0.5.9 | up to date |
| humantime | ^2.0.0 | 2.1.0 | up to date |
| ignore | ^0.4.7 | 0.4.22 | up to date |
| im-rc | ^15.0.0 | 15.1.0 | up to date |
| indexmap | ^1 | 2.2.6 | out of date |
| itertools | ^0.10.0 | 0.12.1 | out of date |
| jobserver | ^0.1.24 | 0.1.31 | up to date |
| lazy_static | ^1.2.0 | 1.4.0 | up to date |
| lazycell | ^1.2.0 | 1.3.0 | up to date |
| libc | ^0.2 | 0.2.153 | up to date |
| libgit2-sys ⚠️ | ^0.13.2 | 0.16.2+1.7.2 | out of date |
| log | ^0.4.6 | 0.4.21 | up to date |
| memchr | ^2.1.3 | 2.7.2 | up to date |
| num_cpus | ^1.0 | 1.16.0 | up to date |
| opener | ^0.5 | 0.7.0 | out of date |
| openssl ⚠️ | ^0.10.11 | 0.10.64 | maybe insecure |
| os_info | ^3.0.7 | 3.8.2 | up to date |
| pathdiff | ^0.2 | 0.2.1 | up to date |
| percent-encoding | ^2.0 | 2.3.1 | up to date |
| pretty_env_logger | ^0.4 | 0.5.0 | out of date |
| rustc-workspace-hack | ^1.0.0 | 1.0.0 | up to date |
| rustfix | ^0.6.0 | 0.8.1 | out of date |
| semver | ^1.0.3 | 1.0.22 | up to date |
| serde | ^1.0.123 | 1.0.198 | up to date |
| serde_ignored | ^0.1.0 | 0.1.10 | up to date |
| serde_json | ^1.0.30 | 1.0.116 | up to date |
| shell-escape | ^0.1.4 | 0.1.5 | up to date |
| strip-ansi-escapes | ^0.1.0 | 0.2.0 | out of date |
| tar | ^0.4.36 | 0.4.40 | up to date |
| tempfile | ^3.0 | 3.10.1 | up to date |
| termcolor | ^1.1 | 1.4.1 | up to date |
| toml_edit | ^0.14.3 | 0.22.12 | out of date |
| unicode-width | ^0.1.5 | 0.1.11 | up to date |
| unicode-xid | ^0.2.0 | 0.2.4 | up to date |
| url | ^2.2.2 | 2.5.0 | up to date |
| walkdir | ^2.2 | 2.5.0 | up to date |
| winapi | ^0.3 | 0.3.9 | up to date |
(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| snapbox | ^0.2.8 | 0.5.9 | out of date |
openssl: `openssl` `X509VerifyParamRef::set_host` buffer over-readWhen this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.
libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:
git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.
It is recommended that all users upgrade.