This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate wasmtime-environ

Dependencies

(21 total, 6 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.0.1001.0.102up to date
 cpp_demangle^0.4.30.5.1out of date
 cranelift-bitset^0.129.10.129.1up to date
 cranelift-entity^0.129.10.129.1up to date
 gimli^0.33.00.33.0up to date
 hashbrown ⚠️^0.150.16.1out of date
 indexmap^2.11.42.13.0up to date
 log^0.4.280.4.29up to date
 object^0.37.30.38.1out of date
 postcard^1.1.31.1.3up to date
 rustc-demangle^0.1.160.1.27up to date
 semver^1.0.271.0.27up to date
 serde^1.0.2281.0.228up to date
 serde_derive^1.0.2281.0.228up to date
 smallvec^1.15.11.15.1up to date
 target-lexicon^0.13.00.13.5up to date
 wasm-encoder^0.244.00.245.1out of date
 wasmparser^0.244.00.245.1out of date
 wasmprinter^0.244.00.245.1out of date
 wasmtime-internal-component-util=42.0.142.0.1up to date
 wasmtime-internal-core=42.0.142.0.1up to date

Dev dependencies

(6 total, 1 outdated)

CrateRequiredLatestStatus
 arbitrary^1.4.21.4.2up to date
 arbtest^0.3.20.3.2up to date
 clap^4.5.484.5.60up to date
 env_logger^0.11.50.11.9up to date
 object^0.37.30.38.1out of date
 wat^1.244.01.245.1up to date

Security Vulnerabilities

hashbrown: Borsh serialization of HashMap is non-canonical

RUSTSEC-2024-0402

The borsh serialization of the HashMap did not follow the borsh specification. It potentially produced non-canonical encodings dependent on insertion order. It also did not perform canonicty checks on decoding.

This can result in consensus splits and cause equivalent objects to be considered distinct.

This was patched in 0.15.1.