Deps.rs

piston_window 0.147.0

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate piston_window

Dependencies

(39 total, 7 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 advancedresearch-nano_ecs^0.9.00.9.0up to date
 camera_controllers^0.36.00.36.0up to date
 collada^0.17.00.17.0up to date
 current^1.0.11.0.1up to date
 dyon^0.51.00.51.2up to date
 find_folder^0.3.00.3.0up to date
 futures^0.3.310.3.34up to date
 gltf^1.4.11.4.1up to date
 hecs^0.10.50.11.1out of date
 image^0.25.90.25.10up to date
 kira^0.11.00.12.3out of date
 lyon^1.0.161.0.19up to date
 nalgebra^0.34.10.35.0out of date
 num^0.4.30.4.3up to date
 piston^1.0.01.0.0up to date
 piston-ai_behavior^0.33.00.33.0up to date
 piston-button_controller^0.13.00.13.0up to date
 piston-dyon_interactive^0.50.00.50.1up to date
 piston-texture^0.9.00.9.0up to date
 piston2d-deform_grid^0.15.00.15.0up to date
 piston2d-drag_controller^0.30.00.30.0up to date
 piston2d-graphics^0.45.00.45.0up to date
 piston2d-sprite^0.69.00.69.0up to date
 piston2d-wgpu_graphics^0.14.00.14.0up to date
 piston_meta^2.0.02.0.1up to date
 pistoncore-winit_window^0.20.20.20.5up to date
 puzzle_design^0.2.00.2.0up to date
 rand^0.9.20.10.2out of date
 rapier2d^0.31.00.35.1out of date
 rapier3d^0.31.00.35.1out of date
 rkyv ⚠️^0.8.120.8.18maybe insecure
 texture_packer^0.30.00.30.0up to date
 turbine^0.3.00.3.0up to date
 turbine_scene3d-wgpu^0.4.00.4.1up to date
 underscore_args^1.0.01.0.0up to date
 vecmath^1.0.01.0.0up to date
 wavefront_obj^11.0.011.0.0up to date
 wgpu^29.0.130.0.0out of date
 winit^0.30.120.30.13up to date

Security Vulnerabilities

rkyv: Crafted archives can cause a use-after-free during deserialization

RUSTSEC-2026-0233

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from_bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap use-after-free during string deserialization.

The flaw could be triggered through the safe checked deserialization API when processing malicious archive bytes. Version 0.8.17 rejects the malformed archive during validation. Users who process untrusted archives should upgrade to 0.8.17 or later.

rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables

RUSTSEC-2026-0234

The archive validator could accept certain malformed relative pointers and invalid ArchivedHashTable states. In particular, the hash table verifier did not ensure that the number of occupied buckets matched the table's declared length.

A crafted archive could pass the checks performed by the safe rkyv::access and rkyv::from_bytes APIs and then cause an out-of-bounds read in later validation, lookup, or deserialization. Depending on the input, this could perform scalar or SIMD reads outside the archive buffer or crash the process.

Version 0.8.17 strengthens archive range validation and rejects hash tables whose number of occupied buckets does not match their declared length. Users who process untrusted archives should upgrade to 0.8.17 or later.

rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

RUSTSEC-2026-0235

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address skipped pointee validation. The safe checked rkyv::access API could consequently return a slice with a forged length, allowing safe indexing to read out of bounds. The same validation bypass was reachable through checked deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.