Deps.rs

Ashutosh0x / rust-finance

[![dependency status](https://deps.rs/repo/github/Ashutosh0x/rust-finance/status.svg)](https://deps.rs/repo/github/Ashutosh0x/rust-finance)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate common

Dependencies

(12 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 serde^1.01.0.228up to date
 zeroize^11.8.2up to date
 serde_json^1.01.0.149up to date
 anyhow^1.01.0.102up to date
 thiserror^1.02.0.18out of date
 chrono ⚠️^0.40.4.44maybe insecure
 tokio^1.351.51.0up to date
 dotenvy^0.150.15.7up to date
 envy^0.40.4.2up to date
 tracing^0.10.1.44up to date
 postcard^1.01.1.3up to date
 compact_str^0.80.9.0out of date

Crate ingestion

Dependencies

(13 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio^1.351.51.0up to date
 async-trait^0.10.1.89up to date
 async-stream^0.30.3.6up to date
 futures^0.30.3.32up to date
 tokio-tungstenite^0.200.29.0out of date
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date
 compact_str^0.80.9.0out of date
 chrono ⚠️^0.40.4.44maybe insecure
 thiserror^1.02.0.18out of date
 anyhow^1.01.0.102up to date
 tracing^0.10.1.44up to date
 reqwest^0.110.13.2out of date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.351.51.0up to date

Crate feature

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 serde^1.01.0.228up to date
 anyhow^1.01.0.102up to date
 dashmap^5.56.1.0out of date

Crate strategy

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.01.0.228up to date
 anyhow^1.01.0.102up to date
 tracing^0.10.1.44up to date

Crate model

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 anyhow^1.01.0.102up to date
 tracing^0.10.1.44up to date

Crate risk

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 compact_str^0.80.9.0out of date
 tracing^0.10.1.44up to date

Crate daemon

Dependencies

(13 total, 2 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 dotenvy^0.150.15.7up to date
 chrono ⚠️^0.40.4.44maybe insecure
 rand^0.80.10.0out of date
 tokio^1.351.51.0up to date
 async-trait^0.10.1.89up to date
 futures^0.30.3.32up to date
 tracing^0.10.1.44up to date
 tracing-subscriber ⚠️^0.30.3.23maybe insecure
 serde^11.0.228up to date
 serde_json^11.0.149up to date
 compact_str^0.80.9.0out of date
 anyhow^1.01.0.102up to date
 clap^4.44.6.0up to date

Crate event_bus

Dependencies

(7 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.351.51.0up to date
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date
 anyhow^1.01.0.102up to date
 tracing^0.10.1.44up to date
 tokio-retry^0.3.00.3.0up to date
 postcard^1.01.1.3up to date

Crate cli

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 clap^4.44.6.0up to date
 anyhow^1.01.0.102up to date
 tokio^1.351.51.0up to date

Crate tui

Dependencies

(11 total, 3 outdated)

CrateRequiredLatestStatus
 ratatui^0.290.30.0out of date
 crossterm^0.270.29.0out of date
 anyhow^1.01.0.102up to date
 tokio^1.351.51.0up to date
 zeroize^11.8.2up to date
 dotenvy^0.150.15.7up to date
 compact_str^0.80.9.0out of date
 postcard^1.01.1.3up to date
 crossbeam-channel^0.50.5.15up to date
 serde_json^1.01.0.149up to date
 tokio-retry^0.3.00.3.0up to date

Crate web

Dependencies

(7 total, 1 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^11.51.0maybe insecure
 axum^0.70.8.8out of date
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date
 tracing^0.10.1.44up to date
 anyhow^1.01.0.102up to date
 tracing-subscriber ⚠️^0.30.3.23maybe insecure

Crate web-dashboard

Dependencies

(9 total, 2 outdated, 3 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^11.51.0maybe insecure
 axum^0.70.8.8out of date
 tokio-tungstenite^0.200.29.0out of date
 futures^0.30.3.32up to date
 serde^11.0.228up to date
 serde_json^11.0.149up to date
 tracing^0.10.1.44up to date
 tracing-subscriber ⚠️^0.30.3.23maybe insecure
 chrono ⚠️^0.40.4.44maybe insecure

Crate dashboard

Dependencies

(7 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^1.01.51.0maybe insecure
 ratatui^0.260.30.0out of date
 crossterm^0.270.29.0out of date
 tracing^0.10.1.44up to date
 anyhow^1.01.0.102up to date
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date

Crate tests

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.351.51.0up to date
 anyhow^1.01.0.102up to date

Crate persistence

Dependencies

(11 total, 4 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 serde>=1.0.2281.0.228up to date
 serde_json^1.01.0.149up to date
 chrono ⚠️^0.40.4.44maybe insecure
 anyhow^1.01.0.102up to date
 tokio ⚠️^11.51.0maybe insecure
 sqlx-core^0.7.40.8.6out of date
 sqlx-postgres^0.7.40.8.6out of date
 sqlx-sqlite^0.7.40.8.6out of date
 uuid^1.01.23.0up to date
 redis^0.261.2.0out of date
 tracing^0.10.1.44up to date

Crate ai

Dependencies

(10 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^1.01.51.0maybe insecure
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date
 reqwest^0.110.13.2out of date
 tracing^0.10.1.44up to date
 anyhow^1.01.0.102up to date
 thiserror^1.02.0.18out of date
 chumsky^0.90.12.0out of date
 schemars^1.2.11.2.1up to date
 jsonschema^0.170.45.0out of date

Crate ml

No external dependencies! 🙌

Crate backtest

Dependencies

(1 total, 1 possibly insecure)

CrateRequiredLatestStatus
 chrono ⚠️^0.40.4.44maybe insecure

Crate compliance

Dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 sha2^0.100.11.0out of date
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date
 tracing^0.10.1.44up to date
 thiserror^1.02.0.18out of date

Crate execution

Dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 async-trait^0.10.1.89up to date
 compact_str^0.80.9.0out of date
 anyhow^1.01.0.102up to date
 tracing^0.10.1.44up to date

Crate alerts

Dependencies

(5 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date
 tokio ⚠️^1.01.51.0maybe insecure
 reqwest^0.120.13.2out of date
 tracing^0.10.1.44up to date

Crate signals

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tracing^0.10.1.44up to date

Crate pricing

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tracing^0.10.1.44up to date

Crate metrics_lib

Dependencies

(3 total, 2 outdated)

CrateRequiredLatestStatus
 metrics^0.230.24.3out of date
 metrics-exporter-prometheus^0.150.18.1out of date
 tracing^0.1.400.1.44up to date

Crate fix

Dependencies

(4 total, 1 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^11.51.0maybe insecure
 tracing^0.10.1.44up to date
 chrono ⚠️^0.40.4.44maybe insecure
 thiserror^1.02.0.18out of date

Crate oms

No external dependencies! 🙌

Crate swarm_sim

Dependencies

(5 total, 3 outdated)

CrateRequiredLatestStatus
 rayon^1.101.11.0up to date
 rand^0.80.10.0out of date
 anyhow^1.01.0.102up to date
 rand_distr^0.40.6.0out of date
 statrs^0.160.18.0out of date

Dev dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 tokio-test^0.40.4.5up to date
 approx^0.50.5.1up to date
 criterion^0.50.8.2out of date

Crate knowledge_graph

Dependencies

(7 total, 1 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 petgraph^0.60.8.3out of date
 serde^11.0.228up to date
 serde_json^11.0.149up to date
 tokio ⚠️^11.51.0maybe insecure
 tracing^0.10.1.44up to date
 chrono ⚠️^0.40.4.44maybe insecure
 anyhow^11.0.102up to date

Crate polymarket

Dependencies

(15 total, 4 outdated)

CrateRequiredLatestStatus
 reqwest^0.120.13.2out of date
 tokio-tungstenite^0.210.29.0out of date
 futures-util^0.30.3.32up to date
 ethers-core^2.02.0.14up to date
 ethers-signers^2.02.0.14up to date
 rust_decimal^1.361.41.0up to date
 rust_decimal_macros^1.361.40.0up to date
 hmac^0.120.13.0out of date
 sha2^0.100.11.0out of date
 base64^0.220.22.1up to date
 hex^0.40.4.3up to date
 url^22.5.8up to date
 dotenvy^0.150.15.7up to date
 envy^0.40.4.2up to date
 anyhow^1.01.0.102up to date

Crate benchmarks

Dev dependencies

(7 total, 2 outdated)

CrateRequiredLatestStatus
 criterion^0.50.8.2out of date
 hdrhistogram^7.57.5.4up to date
 iai^0.10.1.1up to date
 dhat^0.30.3.3up to date
 rand^0.80.10.0out of date
 serde^1.01.0.228up to date
 serde_json^1.01.0.149up to date

Security Vulnerabilities

chrono: Potential segfault in `localtime_r` invocations

RUSTSEC-2020-0159

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

tracing-subscriber: Logging user input may result in poisoning logs with ANSI escape sequences

RUSTSEC-2025-0055

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

  • Manipulate terminal title bars
  • Clear screens or modify terminal display
  • Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

This was patched in PR #3368 to escape ANSI control characters from user input.