Deps.rs

testcontainers 0.23.1

[![dependency status](https://deps.rs/crate/testcontainers/0.23.1/status.svg)](https://deps.rs/crate/testcontainers/0.23.1)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate testcontainers

Dependencies

(25 total, 6 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-trait^0.10.1.92up to date
 bollard^0.17.00.21.1out of date
 bollard-stubs=1.45.0-rc.26.0.11.41.0up to date
 bytes^1.6.01.12.1up to date
 conquer-once^0.40.4.0up to date
 docker_credential^1.3.11.4.0up to date
 either^1.12.01.18.0up to date
 etcetera^0.8.00.11.0out of date
 futures^0.30.3.34up to date
 log^0.40.4.34up to date
 memchr^2.7.22.8.3up to date
 parse-display^0.9.00.11.0out of date
 pin-project-lite^0.2.140.2.17up to date
 reqwest^0.12.50.13.5out of date
 serde^11.0.229up to date
 serde-java-properties^0.2.00.2.0up to date
 serde_json^11.0.151up to date
 serde_with^3.7.03.24.0up to date
 signal-hook^0.30.4.5out of date
 thiserror^1.0.602.0.21out of date
 tokio^11.53.2up to date
 tokio-stream^0.1.150.1.19up to date
 tokio-tar ⚠️^0.3.10.3.1insecure
 tokio-util^0.7.100.7.19up to date
 url^22.5.8up to date

Dev dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.861.0.104up to date
 pretty_env_logger^0.50.5.0up to date
 reqwest^0.12.40.13.5out of date
 temp-dir^0.1.130.2.0out of date
 tokio^11.53.2up to date

Security Vulnerabilities

tokio-tar: `tokio-tar` parses PAX extended headers incorrectly, allows file smuggling

RUSTSEC-2025-0111

The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size (size=000000000000), while a PAX header specifies a non-zero size, tokio-tar::Archive is going to read the file content as tar entry header.

This can be used by a tar file to present different content to tokio-tar compared to other tar reader implementations.

This bug is also known as CVE-2025-62518 and GHSA-j5gw-2vrg-8fgx, as those crates share a common ancestor codebase.

The tokio-tar crate is archived and no longer maintained, we recommend you switch to an alternative crate such as: