This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate near-primitives

Dependencies

(29 total, 19 outdated, 1 insecure)

CrateRequiredLatestStatus
 arbitrary^1.2.31.4.2up to date
 borsh^0.10.21.8.1out of date
 bytesize^1.12.7.0out of date
 cfg-if^11.0.5up to date
 chrono^0.4.190.4.45up to date
 derive_more^0.99.92.1.1out of date
 easy-ext^0.21.0.3out of date
 enum-map^2.1.03.1.0out of date
 hex^0.4.20.4.3up to date
 near-crypto^0.16.10.37.4out of date
 near-o11y^0.16.10.37.4out of date
 near-primitives-core^0.16.10.37.4out of date
 near-rpc-error-macro^0.16.10.26.0out of date
 near-vm-errors^0.16.13.1.0out of date
 num-rational^0.3.10.4.2out of date
 once_cell^1.13.11.21.4up to date
 primitive-types^0.100.14.0out of date
 rand^0.8.50.10.2out of date
 reed-solomon-erasure^46.0.0out of date
 serde^1.0.1361.0.229up to date
 serde_json^1.0.681.0.151up to date
 serde_yaml^0.90.9.34+deprecatedup to date
 smart-default^0.60.7.1out of date
 near-stdx^0.16.00.37.4out of date
 strum^0.240.28.0out of date
 thiserror^1.0.302.0.20out of date
 time^0.3.90.3.55up to date
 tokio ⚠️~1.191.53.1insecure
 tracing^0.1.360.1.44up to date

Dev dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 assert_matches^1.5.01.5.0up to date
 bencher^0.1.50.1.5up to date
 insta^1.26.01.48.0up to date

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);