Deps.rs

gitlab 0.1610.0

[![dependency status](https://deps.rs/crate/gitlab/0.1610.0/status.svg)](https://deps.rs/crate/gitlab/0.1610.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate gitlab

Dependencies

(25 total, 12 outdated, 2 insecure)

CrateRequiredLatestStatus
 async-trait~0.1.90.1.92up to date
 base64~0.130.23.1out of date
 bytes^1.01.12.1up to date
 chrono~0.4.230.4.45up to date
 cron~0.120.17.0out of date
 derive_builder~0.11.20.20.2out of date
 futures-util^0.3.140.3.34up to date
 graphql_client~0.110.16.0out of date
 h2 ⚠️^0.3.240.4.20insecure
 http~0.2.51.5.0out of date
 itertools~0.100.15.0out of date
 log~0.4.60.4.34up to date
 memoffset^0.6.20.9.1out of date
 mio^0.8.111.2.4out of date
 openssl~0.10.600.10.81up to date
 percent-encoding^2.02.3.2up to date
 reqwest~0.11.190.13.5out of date
 rustls-webpki ⚠️^0.101.40.103.15insecure
 serde~1.0.1031.0.229up to date
 serde_json^1.0.701.0.151up to date
 serde_urlencoded~0.70.7.1up to date
 tempfile^3.4.03.27.0up to date
 thiserror^1.0.22.0.21out of date
 url^2.12.5.8up to date
 void^1.0.11.0.2up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 itertools~0.100.15.0out of date
 tokio^1.18.51.53.2up to date

Security Vulnerabilities

rustls-webpki: Name constraints for URI names were incorrectly accepted

RUSTSEC-2026-0098

Name constraints for URI names were ignored and therefore accepted.

Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-965h-392x-2mh5. Thank you to @1seal for the report.

rustls-webpki: Name constraints were accepted for certificates asserting a wildcard name

RUSTSEC-2026-0099

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.

This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.

This vulnerability is identified as GHSA-xgp8-3hg3-c2mh. Thank you to @1seal for the report.

rustls-webpki: Reachable panic in certificate revocation list parsing

RUSTSEC-2026-0104

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.

This panic is reachable prior to a CRL's signature being verified.

Applications that do not use CRLs are not affected.

Thank you to @tynus3 for the report.

h2: h2 unbounded empty DATA frames

RUSTSEC-2026-0258

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.