This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate cargo

Dependencies

(70 total, 18 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 anstream^0.6.50.6.18up to date
 anstyle^1.0.41.0.10up to date
 anyhow^1.0.751.0.95up to date
 base64^0.21.50.22.1out of date
 bytesize^1.31.3.0up to date
 cargo-credential^0.4.20.4.8up to date
 cargo-credential-libsecret^0.4.20.4.10up to date
 cargo-credential-macos-keychain^0.4.20.4.10up to date
 cargo-credential-wincred^0.4.20.4.10up to date
 cargo-platform^0.1.40.1.9up to date
 cargo-util^0.2.60.2.17up to date
 clap^4.4.104.5.27up to date
 color-print^0.3.50.3.7up to date
 crates-io^0.39.00.40.7out of date
 curl^0.4.440.4.47up to date
 curl-sys^0.4.700.4.78+curl-8.11.0up to date
 filetime^0.2.220.2.25up to date
 flate2^1.0.281.0.35up to date
 git2^0.18.10.20.0out of date
 git2-curl^0.19.00.21.0out of date
 gix^0.56.00.70.0out of date
 gix-features^0.35.00.40.0out of date
 glob^0.3.10.3.2up to date
 hex^0.4.30.4.3up to date
 hmac^0.12.10.12.1up to date
 home^0.5.50.5.11up to date
 http-auth^0.1.80.1.10up to date
 humantime^2.1.02.1.0up to date
 ignore^0.4.210.4.23up to date
 im-rc^15.1.015.1.0up to date
 indexmap^22.7.1up to date
 itertools^0.12.00.14.0out of date
 jobserver^0.1.270.1.32up to date
 lazycell^1.3.01.3.0up to date
 libc^0.2.1500.2.169up to date
 libgit2-sys ⚠️^0.16.10.18.0+1.9.0out of date
 memchr^2.6.42.7.4up to date
 opener^0.6.10.7.2out of date
 openssl ⚠️^0.10.570.10.69maybe insecure
 os_info^3.7.03.9.2up to date
 pasetors^0.6.70.7.2out of date
 pathdiff^0.20.2.3up to date
 pulldown-cmark^0.9.30.12.2out of date
 rand^0.8.50.9.0out of date
 regex^1.10.21.11.1up to date
 rusqlite^0.30.00.33.0out of date
 rustfix^0.7.00.9.0out of date
 semver^1.0.201.0.25up to date
 serde^1.0.1931.0.217up to date
 serde-untagged^0.1.10.1.6up to date
 serde-value^0.7.00.7.0up to date
 serde_ignored^0.1.90.1.10up to date
 serde_json^1.0.1081.0.138up to date
 sha1^0.10.60.10.6up to date
 shell-escape^0.1.50.1.5up to date
 supports-hyperlinks^2.1.03.1.0out of date
 syn^2.0.392.0.98up to date
 tar^0.4.400.4.43up to date
 tempfile^3.8.13.16.0up to date
 time^0.30.3.37up to date
 toml^0.8.80.8.19up to date
 toml_edit^0.21.00.22.23out of date
 tracing^0.1.370.1.41up to date
 tracing-subscriber^0.3.180.3.19up to date
 unicase^2.7.02.8.1up to date
 unicode-width^0.1.110.2.0out of date
 unicode-xid^0.2.40.2.6up to date
 url^2.5.02.5.4up to date
 walkdir^2.4.02.5.0up to date
 windows-sys^0.520.59.0out of date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 same-file^1.0.61.0.6up to date
 snapbox^0.4.140.6.21out of date

Security Vulnerabilities

libgit2-sys: Memory corruption, denial of service, and arbitrary code execution in libgit2

RUSTSEC-2024-0013

The libgit2 project fixed three security issues in the 1.7.2 release. These issues are:

  • The git_revparse_single function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the git2 crate via the Repository::revparse_single method.
  • The git_index_add function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the git2 crate via the Index::add method.
  • The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The libgit2-sys crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of libgit2-sys bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.

openssl: `MemBio::get_buf` has undefined behavior with empty buffers

RUSTSEC-2024-0357

Previously, MemBio::get_buf called slice::from_raw_parts with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed.