Deps.rs

cube-js / arrow-rs

[![dependency status](https://deps.rs/repo/github/cube-js/arrow-rs/status.svg)](https://deps.rs/repo/github/cube-js/arrow-rs)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate arrow

Dependencies

(18 total, 8 outdated, 1 insecure)

CrateRequiredLatestStatus
 serde^1.01.0.229up to date
 serde_derive^1.01.0.229up to date
 serde_json^1.01.0.154up to date
 indexmap^1.62.14.2out of date
 rand^0.80.10.3out of date
 getrandom^0.20.4.3out of date
 num^0.40.4.3up to date
 csv^1.11.4.0up to date
 regex^1.31.13.1up to date
 lazy_static^1.41.5.1up to date
 packed_simd_2^0.30.3.8up to date
 chrono^0.40.4.45up to date
 flatbuffers ⚠️=2.0.025.12.19insecure
 hex^0.40.4.3up to date
 comfy-table^4.08.0.1out of date
 lexical-core^0.71.0.6out of date
 multiversion^0.6.10.9.2out of date
 bitflags^1.2.12.13.2out of date

Dev dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 criterion^0.30.8.2out of date
 flate2^11.1.11up to date
 rand^0.80.10.3out of date
 tempfile^33.27.0up to date

Crate parquet

Dependencies

(17 total, 9 outdated)

CrateRequiredLatestStatus
 parquet-format~4.0.04.0.0up to date
 aes-gcm^0.10.30.11.1out of date
 byteorder^11.5.0up to date
 thrift^0.130.25.0out of date
 snap^1.01.1.2up to date
 brotli^3.39.1.1out of date
 flate2^1.01.1.11up to date
 lz4^1.231.28.1up to date
 zstd^0.120.14.3out of date
 chrono^0.40.4.45up to date
 num-bigint^0.40.5.1out of date
 base64^0.130.23.1out of date
 clap^2.33.34.6.7out of date
 serde_json^1.01.0.154up to date
 serde^1.0.1151.0.229up to date
 rand^0.80.10.3out of date
 sha3^0.10.80.12.0out of date

Dev dependencies

(7 total, 3 outdated)

CrateRequiredLatestStatus
 criterion^0.30.8.2out of date
 rand^0.80.10.3out of date
 snap^1.01.1.2up to date
 brotli^3.39.1.1out of date
 flate2^1.01.1.11up to date
 lz4^1.231.28.1up to date
 serde_json^1.01.0.154up to date

Crate parquet_derive

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 proc-macro2^1.01.0.107up to date
 quote^1.01.0.47up to date
 syn^1.03.0.9out of date

Crate parquet_derive_test

No external dependencies! 🙌

Crate arrow-flight

Dependencies

(6 total, 4 outdated)

CrateRequiredLatestStatus
 base64^0.130.23.1out of date
 tonic^0.40.14.9out of date
 bytes^11.12.1up to date
 prost^0.70.14.4out of date
 prost-derive^0.70.14.4out of date
 tokio^1.01.54.1up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 futures^0.30.3.34up to date

Build dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 tonic-build^0.40.14.9out of date
 proc-macro2^1.0.271.0.107up to date

Crate arrow-integration-testing

Dependencies

(11 total, 4 outdated, 1 insecure)

CrateRequiredLatestStatus
 async-trait^0.1.410.1.92up to date
 clap^2.334.6.7out of date
 futures^0.30.3.34up to date
 hex^0.40.4.3up to date
 prost^0.70.14.4out of date
 serde^1.01.0.229up to date
 serde_derive^1.01.0.229up to date
 serde_json^1.01.0.154up to date
 tokio^1.01.54.1up to date
 tonic^0.40.14.9out of date
 tracing-subscriber ⚠️^0.2.150.3.23insecure

Security Vulnerabilities

flatbuffers: Generated code can read and write out of bounds in safe code

RUSTSEC-2021-0122

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details.

For example, if generated code is used to decode malformed or untrusted input, undefined behavior (and thus security vulnerabilities) is possible even without the use of the unsafe keyword, violating the the meaning of "safe" code;

All users that use generated code by flatbuffers compiler are recommended to:

  1. not expose flatbuffer generated code as part of their public APIs
  2. audit their code and look for any usage of follow, push, or any method that uses them (e.g. self_follow).
  3. Carefully go through the crates' documentation to understand which "safe" APIs are not intended to be used.

tracing-subscriber: Logging user input may result in poisoning logs with ANSI escape sequences

RUSTSEC-2025-0055

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

  • Manipulate terminal title bars
  • Clear screens or modify terminal display
  • Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

This was patched in PR #3368 to escape ANSI control characters from user input.