This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate rsky-common

Dependencies

(12 total, 1 outdated)

CrateRequiredLatestStatus
 regex^1.8.41.11.1up to date
 serde^1.0.2171.0.219up to date
 thiserror^2.0.112.0.12up to date
 anyhow^1.0.791.0.97up to date
 chrono^0.4.390.4.40up to date
 url^2.5.42.5.4up to date
 serde_json^1.0.1381.0.140up to date
 tracing^0.1.410.1.41up to date
 base64ct^1.6.01.7.3up to date
 urlencoding^2.1.32.1.3up to date
 futures^0.3.280.3.31up to date
 indexmap^1.9.32.8.0out of date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 temp-env^0.3.60.3.6up to date

Crate rsky-crypto

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 multibase^0.9.10.9.1up to date
 anyhow^1.0.791.0.97up to date
 p256^0.13.20.13.2up to date
 unsigned-varint^0.8.00.8.0up to date

Crate rsky-feedgen

Dependencies

(18 total, 5 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 rocket=0.5.10.5.1up to date
 serde^1.0.1601.0.219up to date
 serde_derive^1.01.0.219up to date
 serde_bytes^0.11.90.11.17up to date
 serde_ipld_dagcbor^0.3.00.6.2out of date
 serde_json^1.0.961.0.140up to date
 serde_cbor^0.11.20.11.2up to date
 diesel ⚠️=2.1.52.2.8out of date
 dotenvy^0.150.15.7up to date
 chrono^0.4.260.4.40up to date
 regex^1.8.41.11.1up to date
 base64^0.21.20.22.1out of date
 rand^0.8.50.9.0out of date
 once_cell^1.19.01.21.1up to date
 moka^0.120.12.10up to date
 chrono-tz^0.10.10.10.1up to date
 rocket_sync_db_pools=0.1.00.1.0up to date
 reqwest^0.110.12.14out of date

Dev dependencies

(3 total, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^11.44.1maybe insecure
 temp-env^0.3.60.3.6up to date
 serial_test*3.2.0up to date

Crate rsky-firehose

Dependencies

(21 total, 5 outdated)

CrateRequiredLatestStatus
 ciborium^0.2.00.2.2up to date
 futures^0.3.280.3.31up to date
 tokio^1.28.01.44.1up to date
 tokio-tungstenite^0.18.00.26.2out of date
 url^2.3.12.5.4up to date
 chrono^0.4.240.4.40up to date
 derive_builder^0.12.00.20.2out of date
 miette^5.8.07.5.0out of date
 parking_lot^0.12.10.12.3up to date
 reqwest^0.11.160.12.14out of date
 serde^1.0.1601.0.219up to date
 serde_derive^1.01.0.219up to date
 serde_bytes^0.11.90.11.17up to date
 serde_ipld_dagcbor^0.6.10.6.2up to date
 serde_json^1.0.961.0.140up to date
 serde_cbor^0.11.20.11.2up to date
 thiserror^1.0.402.0.12out of date
 dotenvy^0.15.70.15.7up to date
 retry^2.0.02.0.0up to date
 anyhow^1.0.811.0.97up to date
 libipld^0.16.00.16.0up to date

Crate rsky-identity

Dependencies

(8 total, 1 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.821.0.97up to date
 reqwest^0.12.30.12.14up to date
 serde_json^1.0.1151.0.140up to date
 urlencoding^2.1.32.1.3up to date
 thiserror^1.0.582.0.12out of date
 url^2.5.02.5.4up to date
 serde^1.0.1971.0.219up to date
 hickory-resolver^0.24.10.24.4up to date

Crate rsky-labeler

Dependencies

(23 total, 1 outdated)

CrateRequiredLatestStatus
 ciborium^0.2.00.2.2up to date
 futures^0.3.280.3.31up to date
 tokio^1.28.01.44.1up to date
 tokio-tungstenite^0.26.10.26.2up to date
 chrono^0.4.240.4.40up to date
 derive_builder^0.20.20.20.2up to date
 miette^7.4.07.5.0up to date
 parking_lot^0.12.10.12.3up to date
 reqwest^0.12.90.12.14up to date
 serde^1.0.1601.0.219up to date
 serde_derive^1.01.0.219up to date
 serde_bytes^0.11.90.11.17up to date
 serde_ipld_dagcbor^0.6.10.6.2up to date
 serde_json^1.0.961.0.140up to date
 serde_cbor^0.11.20.11.2up to date
 thiserror^2.0.92.0.12up to date
 dotenvy^0.15.70.15.7up to date
 retry^2.0.02.0.0up to date
 anyhow^1.0.811.0.97up to date
 libipld^0.16.00.16.0up to date
 atrium-api^0.24.60.25.0out of date
 atrium-xrpc-client^0.5.80.5.11up to date
 ipld-core^0.4.10.4.2up to date

Crate rsky-lexicon

Dependencies

(8 total, 3 outdated)

CrateRequiredLatestStatus
 chrono^0.4.240.4.40up to date
 derive_builder^0.12.00.20.2out of date
 miette^5.8.07.5.0out of date
 parking_lot^0.12.10.12.3up to date
 serde_derive^1.01.0.219up to date
 serde_bytes^0.11.90.11.17up to date
 thiserror^1.0.402.0.12out of date
 anyhow^1.0.791.0.97up to date

Crate rsky-pds

Dependencies

(40 total, 7 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 rocket=0.5.10.5.1up to date
 dotenvy^0.150.15.7up to date
 diesel ⚠️=2.1.52.2.8out of date
 chrono^0.4.260.4.40up to date
 serde_repr^0.10.1.20up to date
 email_address^0.2.40.2.9up to date
 anyhow^1.0.791.0.97up to date
 base64^0.22.00.22.1up to date
 data-encoding^2.5.02.8.0up to date
 reqwest^0.12.30.12.14up to date
 base64-url^2.0.23.0.0out of date
 indexmap^1.9.32.8.0out of date
 hex^0.4.30.4.3up to date
 lazy_static^1.4.01.5.0up to date
 regex^1.10.31.11.1up to date
 thiserror^1.0.402.0.12out of date
 aws-sdk-s3^1.29.01.79.0up to date
 aws-config^1.1.81.6.0up to date
 futures^0.3.280.3.31up to date
 jwt-simple^0.12.90.12.12up to date
 argon2^0.5.30.5.3up to date
 base64ct^1.6.01.7.3up to date
 mailgun-rs^0.1.101.0.1out of date
 mailchecker^6.0.16.0.17up to date
 image^0.25.10.25.5up to date
 infer^0.15.00.19.0out of date
 toml^0.8.120.8.20up to date
 rocket_ws^0.1.10.1.1up to date
 atrium-api^0.24.60.25.0out of date
 atrium-xrpc-client^0.5.80.5.11up to date
 ipld-core^0.4.10.4.2up to date
 time^0.3.360.3.39up to date
 url^2.5.22.5.4up to date
 async-event-emitter^0.1.30.1.4up to date
 event-emitter-rs^0.1.40.1.4up to date
 webpki-roots^0.26.0-alpha.10.26.8up to date
 once_cell^1.19.01.21.1up to date
 tracing^0.1.410.1.41up to date
 tracing-subscriber^0.3.190.3.19up to date
 rocket_sync_db_pools=0.1.00.1.0up to date

Crate rsky-syntax

Dependencies

(8 total, 1 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.861.0.97up to date
 chrono^0.4.390.4.40up to date
 lazy_static^1.5.01.5.0up to date
 regex^1.10.51.11.1up to date
 serde^1.0.1601.0.219up to date
 serde_derive^1.01.0.219up to date
 thiserror^1.0.402.0.12out of date
 url^2.5.22.5.4up to date

Crate rsky-jetstream-subscriber

Dependencies

(13 total, 2 outdated)

CrateRequiredLatestStatus
 tracing^0.10.1.41up to date
 tracing-subscriber^0.30.3.19up to date
 futures^0.3.280.3.31up to date
 tokio^1.28.01.44.1up to date
 tokio-tungstenite^0.18.00.26.2out of date
 url^2.3.12.5.4up to date
 chrono^0.4.240.4.40up to date
 reqwest^0.11.160.12.14out of date
 serde^1.0.1601.0.219up to date
 serde_derive^1.01.0.219up to date
 serde_json^1.0.961.0.140up to date
 dotenvy^0.15.70.15.7up to date
 anyhow^1.0.811.0.97up to date

Crate rsky-repo

Dependencies

(11 total, 4 outdated)

CrateRequiredLatestStatus
 async-recursion^1.1.11.1.1up to date
 anyhow^1.0.791.0.97up to date
 futures^0.3.280.3.31up to date
 thiserror^1.0.402.0.12out of date
 async-stream^0.3.50.3.6up to date
 async-trait^0.1.860.1.87up to date
 integer-encoding^34.0.2out of date
 rand^0.8.50.9.0out of date
 rand_core^0.6.40.9.3out of date
 regex^1.10.31.11.1up to date
 lazy_static^1.4.01.5.0up to date

Crate backend

Dependencies

(28 total, 1 outdated)

CrateRequiredLatestStatus
 axum^0.8.10.8.1up to date
 surrealdb^2.2.12.2.1up to date
 uuid^11.15.1up to date
 tower-http^0.6.20.6.2up to date
 chrono^0.4.400.4.40up to date
 atrium-identity^0.1.00.1.1up to date
 thiserror^2.0.122.0.12up to date
 atrium-api^0.25.00.25.0up to date
 atrium-common^0.1.00.1.0up to date
 atrium-xrpc^0.12.10.12.1up to date
 base64^0.22.10.22.1up to date
 ecdsa^0.16.90.16.9up to date
 elliptic-curve^0.13.80.13.8up to date
 jose-jwa^0.1.20.1.2up to date
 jose-jwk^0.1.20.1.2up to date
 p256^0.13.20.13.2up to date
 reqwest^0.12.120.12.14up to date
 serde_html_form^0.2.70.2.7up to date
 trait-variant^0.1.20.1.2up to date
 hickory-resolver^0.24.10.24.4up to date
 anyhow^1.0.971.0.97up to date
 tokio-tungstenite^0.23.10.26.2out of date
 futures^0.3.310.3.31up to date
 tracing^0.1.410.1.41up to date
 tokio-stream^0.1.170.1.17up to date
 axum-extra^0.10.00.10.0up to date
 headers^0.40.4.0up to date
 tower^0.5.20.5.2up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 p256^0.13.20.13.2up to date

Crate frontend

Dependencies

(8 total, all up-to-date)

CrateRequiredLatestStatus
 dioxus^0.6.10.6.3up to date
 web-sys^0.3.770.3.77up to date
 wasm-bindgen^0.2.1000.2.100up to date
 js-sys^0.3.770.3.77up to date
 chrono^0.4.400.4.40up to date
 wasm-bindgen-futures^0.4.500.4.50up to date
 reqwest^0.12.120.12.14up to date
 gloo-storage^0.3.00.3.0up to date

Crate rsky-satnav

Dependencies

(12 total, 1 outdated)

CrateRequiredLatestStatus
 getrandom^0.20.3.1out of date
 dioxus^0.6.00.6.3up to date
 wasm-bindgen^0.2.1000.2.100up to date
 web-sys^0.3.770.3.77up to date
 wasm-bindgen-futures^0.4.500.4.50up to date
 gloo-file^0.3.00.3.0up to date
 anyhow^1.0.971.0.97up to date
 dioxus-web^0.6.30.6.3up to date
 iroh-car^0.5.10.5.1up to date
 base64^0.22.10.22.1up to date
 ipld-core^0.4.20.4.2up to date
 hex^0.40.4.3up to date

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

diesel: Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

RUSTSEC-2024-0365

The following presentation at this year's DEF CON was brought to our attention on the Diesel Gitter Channel:

SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
(Archive link for posterity.) Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow, causing the server to interpret the rest of the string as binary protocol commands or other data.

It appears Diesel does perform truncating casts in a way that could be problematic, for example: https://github.com/diesel-rs/diesel/blob/ae82c4a5a133db65612b7436356f549bfecda1c7/diesel/src/pg/connection/stmt/mod.rs#L36

This code has existed essentially since the beginning, so it is reasonable to assume that all published versions <= 2.2.2 are affected.

Mitigation

The prefered migration to the outlined problem is to update to a Diesel version newer than 2.2.2, which includes fixes for the problem.

As always, you should make sure your application is validating untrustworthy user input. Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB. Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.

For web application backends, consider adding some middleware that limits the size of request bodies by default.

Resolution

Diesel now uses #[deny] directives for the following Clippy lints:

to prevent casts that will lead to precision loss or other trunctations. Additionally we performed an audit of the relevant code.

A fix is included in the 2.2.3 release.