Deps.rs

kiddo 4.2.1

[![dependency status](https://deps.rs/crate/kiddo/4.2.1/status.svg)](https://deps.rs/crate/kiddo/4.2.1)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate kiddo

Dependencies

(23 total, 5 outdated, 1 insecure)

CrateRequiredLatestStatus
 az^11.3.0up to date
 divrem^11.0.0up to date
 doc-comment^0.30.3.4up to date
 elapsed^0.10.1.2up to date
 fixed^11.31.0up to date
 generator^0.8.10.8.10up to date
 half^2.32.7.1up to date
 init_with^11.1.0up to date
 itertools^0.130.15.0out of date
 log^0.40.4.34up to date
 num-traits^0.20.2.19up to date
 ordered-float^45.5.0out of date
 rand^0.80.10.3out of date
 rand_chacha^0.30.10.0out of date
 rayon^11.12.0up to date
 rkyv ⚠️^0.70.8.18insecure
 serde^11.0.229up to date
 serde_derive^11.0.229up to date
 serde_with^33.23.0up to date
 sorted-vec^0.80.8.11up to date
 tracing^0.10.1.44up to date
 tracing-subscriber^0.30.3.23up to date
 ubyte^0.100.10.4up to date

Dev dependencies

(14 total, 5 outdated)

CrateRequiredLatestStatus
 bincode^1.33.0.0out of date
 codspeed-criterion-compat^25.0.2out of date
 criterion^0.50.8.2out of date
 csv^11.4.0up to date
 flate2^11.1.10up to date
 log^0.40.4.34up to date
 memmap^0.70.7.0up to date
 proc-macro2^11.0.107up to date
 radians^0.30.3.1up to date
 rand^0.80.10.3out of date
 rand_distr^0.40.6.0out of date
 rayon^11.12.0up to date
 serde^11.0.229up to date
 serde_json^1.01.0.151up to date

Security Vulnerabilities

rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

RUSTSEC-2026-0235

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address skipped pointee validation. The safe checked rkyv::access API could consequently return a slice with a forged length, allowing safe indexing to read out of bounds. The same validation bypass was reachable through checked deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.