This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate moka

Dependencies

(14 total, 1 possibly insecure)

CrateRequiredLatestStatus
 async-lock^3.33.4.2up to date
 crossbeam-channel^0.5.150.5.16up to date
 crossbeam-epoch ⚠️^0.9.180.9.20maybe insecure
 crossbeam-utils^0.8.210.8.22up to date
 equivalent^1.01.0.2up to date
 event-listener^5.35.4.1up to date
 futures-util^0.3.170.3.33up to date
 log^0.40.4.33up to date
 parking_lot^0.120.12.5up to date
 portable-atomic^1.61.14.0up to date
 quanta^0.12.20.12.6up to date
 smallvec^1.81.15.2up to date
 tagptr^0.20.2.0up to date
 uuid^1.11.24.0up to date

Dev dependencies

(11 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 actix-rt^2.82.11.0up to date
 ahash^0.8.30.8.12up to date
 anyhow^1.0.191.0.104up to date
 env_logger^0.10.00.11.11out of date
 getrandom^0.20.4.3out of date
 loom^0.70.7.2up to date
 once_cell^1.71.21.4up to date
 rand^0.8.50.10.2out of date
 reqwest^0.120.13.4out of date
 tokio ⚠️^1.191.53.1maybe insecure
 trybuild^1.01.0.118up to date

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

crossbeam-epoch: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

RUSTSEC-2026-0204

Affected versions of fmt::Display dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with Atomic::null or Shared::null. fmt::Debug impls and pre-0.9 fmt::Display impls, which do not dereference pointers, are not affected by this issue.