Deps.rs

cargo 0.75.1

[![dependency status](https://deps.rs/crate/cargo/0.75.1/status.svg)](https://deps.rs/crate/cargo/0.75.1)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate cargo

Dependencies

(67 total, 11 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anstream^0.6.30.6.14up to date
 anstyle^1.0.41.0.7up to date
 anyhow^1.0.751.0.86up to date
 base64^0.21.30.22.1out of date
 bytesize^1.31.3.0up to date
 cargo-credential^0.4.00.4.4up to date
 cargo-credential-libsecret^0.4.00.4.4up to date
 cargo-credential-macos-keychain^0.4.00.4.4up to date
 cargo-credential-wincred^0.4.00.4.4up to date
 cargo-platform^0.1.40.1.8up to date
 cargo-util^0.2.60.2.11up to date
 clap^4.4.64.5.4up to date
 color-print^0.3.40.3.6up to date
 crates-io^0.39.00.40.1out of date
 curl^0.4.440.4.46up to date
 curl-sys^0.4.680.4.72+curl-8.6.0up to date
 filetime^0.2.220.2.23up to date
 flate2^1.0.271.0.30up to date
 git2^0.18.00.18.3up to date
 git2-curl^0.19.00.19.0up to date
 gix^0.54.10.62.0out of date
 gix-features^0.35.00.38.1out of date
 glob^0.3.10.3.1up to date
 hex^0.4.30.4.3up to date
 hmac^0.12.10.12.1up to date
 home^0.5.50.5.9up to date
 http-auth^0.1.80.1.9up to date
 humantime^2.1.02.1.0up to date
 ignore^0.4.200.4.22up to date
 im-rc^15.1.015.1.0up to date
 indexmap^22.2.6up to date
 itertools^0.10.00.13.0out of date
 jobserver^0.1.260.1.31up to date
 lazycell^1.3.01.3.0up to date
 libc^0.2.1480.2.155up to date
 libgit2-sys ⚠️^0.16.10.16.2+1.7.2maybe insecure
 memchr^2.6.22.7.2up to date
 opener^0.6.10.7.1out of date
 openssl^0.10.570.10.64up to date
 os_info^3.7.03.8.2up to date
 pasetors^0.6.70.6.8up to date
 pathdiff^0.20.2.1up to date
 pulldown-cmark^0.9.30.11.0out of date
 rand^0.8.50.8.5up to date
 rustfix^0.6.10.8.2out of date
 semver^1.0.181.0.23up to date
 serde^1.0.1881.0.202up to date
 serde-untagged^0.1.10.1.6up to date
 serde-value^0.7.00.7.0up to date
 serde_ignored^0.1.90.1.10up to date
 serde_json^1.0.1051.0.117up to date
 sha1^0.10.50.10.6up to date
 shell-escape^0.1.50.1.5up to date
 syn^2.0.292.0.64up to date
 tar^0.4.400.4.40up to date
 tempfile^3.8.03.10.1up to date
 time^0.30.3.36up to date
 toml^0.7.60.8.13out of date
 toml_edit^0.19.140.22.13out of date
 tracing^0.1.370.1.40up to date
 tracing-subscriber^0.3.170.3.18up to date
 unicase^2.7.02.7.0up to date
 unicode-width^0.1.100.1.12up to date
 unicode-xid^0.2.40.2.4up to date
 url^2.4.12.5.0up to date
 walkdir^2.3.32.5.0up to date
 windows-sys^0.480.52.0out of date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 same-file^1.0.61.0.6up to date
 snapbox^0.4.130.5.12out of date

Security Vulnerabilities

libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2

RUSTSEC-2024-0013

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

  • The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
  • The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
  • The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.