Deps.rs

fawn / tamako

[![dependency status](https://deps.rs/repo/codeberg/fawn/tamako/status.svg)](https://deps.rs/repo/codeberg/fawn/tamako)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate tamako

Dependencies

(18 total, 5 outdated, 1 insecure)

CrateRequiredLatestStatus
 tokio^1.47.11.54.1up to date
 actix-web^4.11.04.19.0up to date
 actix-files ⚠️^0.6.60.7.4insecure
 actix-governor^0.8.00.10.0out of date
 actix-logger^0.4.10.4.1up to date
 askama^0.14.00.16.1out of date
 askama_web^0.14.60.16.0out of date
 sqlx^0.8.60.9.0out of date
 serde^1.0.2191.0.229up to date
 twink^1.1.31.1.3up to date
 log^0.4.270.4.35up to date
 eyre^0.6.120.6.14up to date
 dotenvy^0.15.70.15.7up to date
 chrono^0.4.410.4.45up to date
 chrono-tz^0.10.40.10.4up to date
 webhook^2.1.22.1.2up to date
 rs-snowflake^0.6.00.6.0up to date
 once_cell^1.21.31.21.4up to date

Security Vulnerabilities

actix-files: Hidden file disclosure through Windows short names

RUSTSEC-2026-0443

On Windows volumes with 8.3 short names, actix_files::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.

A remote client can read files such as .env or .git/config in the served directory even when use_hidden_files() is not enabled. This can expose secrets or source code.

Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.