Deps.rs

nalgebra 0.34.2

[![dependency status](https://deps.rs/crate/nalgebra/0.34.2/status.svg)](https://deps.rs/crate/nalgebra/0.34.2)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate nalgebra

Dependencies

(24 total, 5 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 alga^0.90.9.3up to date
 approx^0.50.5.1up to date
 bytemuck^1.51.25.2up to date
 defmt^1.0.11.1.1up to date
 encase^0.120.12.0up to date
 glam^0.320.33.3out of date
 matrixcompare-core^0.10.1.0up to date
 matrixmultiply^0.30.3.11up to date
 mint^0.50.5.9up to date
 nalgebra-macros^0.3.00.3.0up to date
 num-complex^0.40.4.6up to date
 num-rational^0.40.4.2up to date
 num-traits^0.20.2.19up to date
 pest^22.9.0up to date
 pest_derive^22.9.0up to date
 proptest^11.11.0up to date
 quickcheck^11.1.0up to date
 rand^0.90.10.2out of date
 rand_distr^0.50.6.0out of date
 rayon^1.61.12.0up to date
 rkyv ⚠️^0.7.410.8.18out of date
 serde^1.01.0.229up to date
 simba^0.90.10.2out of date
 typenum^1.121.20.1up to date

Dev dependencies

(8 total, 4 outdated)

CrateRequiredLatestStatus
 cool_asserts^2.0.32.0.4up to date
 criterion^0.70.8.2out of date
 itertools^0.130.15.0out of date
 matrixcompare^0.3.00.3.0up to date
 rand_isaac^0.40.5.1out of date
 rand_xorshift^0.40.5.0out of date
 serde_json^1.01.0.151up to date
 trybuild^1.0.901.0.120up to date

Security Vulnerabilities

rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

RUSTSEC-2026-0235

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address skipped pointee validation. The safe checked rkyv::access API could consequently return a slice with a forged length, allowing safe indexing to read out of bounds. The same validation bypass was reachable through checked deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.