Deps.rs

stylo 0.3.0

[![dependency status](https://deps.rs/crate/stylo/0.3.0/status.svg)](https://deps.rs/crate/stylo/0.3.0)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate stylo

Dependencies

(50 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 app_units^0.7.80.7.8up to date
 arrayvec^0.70.7.6up to date
 atomic_refcell^0.10.1.13up to date
 bitflags^22.9.1up to date
 byteorder^1.01.5.0up to date
 cssparser^0.350.35.0up to date
 derive_more^0.992.0.1out of date
 stylo_dom^0.30.3.0up to date
 encoding_rs^0.80.8.35up to date
 euclid^0.220.22.11up to date
 fxhash^0.20.2.1up to date
 icu_segmenter^1.52.0.0out of date
 indexmap^22.9.0up to date
 itertools^0.140.14.0up to date
 itoa^1.01.0.15up to date
 lazy_static^11.5.0up to date
 log^0.40.4.27up to date
 stylo_malloc_size_of^0.30.3.0up to date
 malloc_size_of_derive^0.10.1.3up to date
 matches^0.10.1.10up to date
 mime^0.3.130.3.17up to date
 new_debug_unreachable^1.01.0.6up to date
 num-derive^0.40.4.2up to date
 num-integer^0.10.1.46up to date
 num-traits^0.20.2.19up to date
 num_cpus^1.1.01.17.0up to date
 parking_lot^0.120.12.4up to date
 precomputed-hash^0.1.10.1.1up to date
 rayon^11.10.0up to date
 rayon-core^11.12.1up to date
 selectors^0.28.00.28.0up to date
 serde^1.01.0.219up to date
 servo_arc^0.4.00.4.0up to date
 smallbitvec^2.3.02.6.0up to date
 smallvec ⚠️^1.01.15.1maybe insecure
 static_assertions^1.11.1.0up to date
 stylo_static_prefs^0.30.3.0up to date
 string_cache^0.80.8.9up to date
 stylo_config^0.30.3.0up to date
 stylo_derive^0.30.3.0up to date
 stylo_traits^0.30.3.0up to date
 stylo_atoms^0.30.3.0up to date
 thin-vec^0.2.10.2.14up to date
 to_shmem^0.20.2.0up to date
 to_shmem_derive^0.10.1.0up to date
 uluru^3.03.1.0up to date
 unicode-bidi^0.30.3.18up to date
 url^2.52.5.4up to date
 void^1.0.21.0.2up to date
 web_atoms^0.10.1.3up to date

Security Vulnerabilities

smallvec: Buffer overflow in SmallVec::insert_many

RUSTSEC-2021-0003

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.

This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Thank you to Yechan Bae (@Qwaz) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.