Deps.rs

deno_doc 0.139.0

[![dependency status](https://deps.rs/crate/deno_doc/0.139.0/status.svg)](https://deps.rs/crate/deno_doc/0.139.0)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate deno_doc

Dependencies

(28 total, 16 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 ammonia ⚠️^3.3.04.1.4out of date
 anyhow^1.0.581.0.104up to date
 cfg-if^1.0.01.0.4up to date
 comrak^0.20.00.55.0out of date
 deno_ast^0.39.00.53.3out of date
 deno_graph^0.78.00.111.0out of date
 futures^0.3.260.3.34up to date
 handlebars^5.06.4.4out of date
 html-escape^0.2.130.2.15up to date
 import_map^0.19.00.25.0out of date
 indexmap^2.0.22.14.2up to date
 lazy_static^1.4.01.5.0up to date
 regex^1.6.01.13.1up to date
 serde^1.0.1401.0.229up to date
 serde_json^1.0.821.0.151up to date
 syntect^5.1.05.3.0up to date
 termcolor^1.1.21.4.1up to date
 tree-sitter-bash^0.20.50.25.1out of date
 tree-sitter-css^0.20.00.25.0out of date
 tree-sitter-highlight^0.20.10.27.0out of date
 tree-sitter-html^0.20.00.23.2out of date
 tree-sitter-javascript^0.20.10.25.0out of date
 tree-sitter-json^0.20.10.24.8out of date
 tree-sitter-md^0.1.70.5.3out of date
 tree-sitter-regex^0.20.00.25.0out of date
 tree-sitter-rust^0.20.40.24.2out of date
 tree-sitter-toml^0.20.00.20.0up to date
 tree-sitter-typescript^0.20.30.23.2out of date

Dev dependencies

(8 total, 4 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.581.0.104up to date
 clap^2.33.34.6.6out of date
 console_static_text^0.8.20.9.0out of date
 criterion^0.4.00.8.2out of date
 file_test_runner^0.7.00.12.1out of date
 insta^1.38.01.48.0up to date
 pretty_assertions^1.0.01.4.1up to date
 tokio^1.25.01.53.1up to date

Security Vulnerabilities

ammonia: XSS in ammonia via SVG `animate` and `set` animation tags

RUSTSEC-2026-0213

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)