Deps.rs

dabreegster / abstreet

[![dependency status](https://deps.rs/repo/github/dabreegster/abstreet/status.svg)](https://deps.rs/repo/github/dabreegster/abstreet)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate abstio

Dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 base64^0.21.50.23.1out of date
 reqwest^0.11.220.13.5out of date
 tokio^1.34.01.53.1up to date
 js-sys^0.3.650.3.105up to date

Crate abstutil

Dependencies

(6 total, 3 outdated)

CrateRequiredLatestStatus
 env_logger^0.10.10.11.11out of date
 itertools^0.12.00.15.0out of date
 num_cpus^1.16.01.17.0up to date
 scoped_threadpool^0.1.90.1.9up to date
 termion^2.0.34.0.6out of date
 console_log^1.0.01.1.0up to date

Crate blockfinding

No external dependencies! 🙌

Crate cli

Dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 osmio^0.8.10.16.1out of date
 rand^0.8.30.10.2out of date

Crate collisions

No external dependencies! 🙌

Crate convert_osm

No external dependencies! 🙌

Crate headless

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 hyper^0.14.261.11.1out of date
 lazy_static^1.4.01.5.0up to date
 url^2.5.02.5.8up to date

Crate importer

Dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 gdal^0.14.00.19.0out of date
 rand^0.8.30.10.2out of date

Crate kml

Dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 roxmltree^0.19.00.21.1out of date

Crate map_gui

Dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 built^0.7.10.8.1out of date
 chrono^0.4.310.4.45up to date
 lyon^1.0.11.0.19up to date
 regex^1.10.21.13.1up to date
 rfd^0.11.30.17.2out of date

Build dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 built^0.7.10.8.1out of date

Crate map_model

Dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 enumset^1.1.31.1.14up to date
 lyon^1.0.11.0.19up to date
 md5^0.7.00.8.1out of date
 petgraph^0.6.40.8.3out of date
 thread_local^1.1.71.1.10up to date

Crate piggyback

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 js-sys^0.3.510.3.105up to date

Crate popdat

Dependencies

(3 total, 3 outdated)

CrateRequiredLatestStatus
 flatgeobuf^3.25.06.0.1out of date
 geozero^0.9.90.15.1out of date
 rand_distr^0.4.30.6.0out of date

Crate popgetter

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 geo-types^0.7.120.7.20up to date

Crate raw_map

Dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 strum^0.24.10.28.0out of date
 strum_macros^0.24.30.28.0out of date

Crate sim

Dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 ctrlc^3.4.13.5.2up to date
 downcast-rs^1.2.02.0.2out of date
 enum_dispatch^0.3.120.3.13up to date
 libm^0.2.80.2.16up to date
 rand_distr^0.4.30.6.0out of date

Crate synthpop

Dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 rand^0.8.50.10.2out of date

Crate tests

Dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 prettydiff^0.6.40.9.0out of date

Crate traffic_seitan

No external dependencies! 🙌

Crate updater

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 md5^0.7.00.8.1out of date
 walkdir^2.4.02.5.0up to date

Crate widgetry

Dependencies

(16 total, 11 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 clipboard^0.5.00.5.0up to date
 downcast-rs^1.2.02.0.2out of date
 glow^0.12.10.18.0out of date
 htmlescape^0.3.10.3.1up to date
 image^0.24.60.25.10out of date
 js-sys^0.3.470.3.105up to date
 lru^0.10.00.18.4out of date
 lyon^1.0.01.0.19up to date
 taffy^0.2.20.14.0out of date
 ttf-parser^0.19.00.25.1out of date
 usvg^0.32.00.48.1out of date
 usvg-text-layout^0.32.00.38.0out of date
 wasm-bindgen-futures^0.4.340.4.78up to date
 wasm-streams^0.3.00.7.0out of date
 webbrowser ⚠️^0.8.91.2.4out of date
 winit^0.27.00.30.13out of date

Crate widgetry_demo

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 svg_face^0.1.30.1.3up to date

Crate ltn

Dependencies

(5 total, 1 outdated)

CrateRequiredLatestStatus
 home^0.5.50.5.12up to date
 lazy_static^1.4.01.5.0up to date
 maplit^1.0.21.0.2up to date
 md5^0.7.00.8.1out of date
 regex^1.8.11.13.1up to date

Security Vulnerabilities

webbrowser: Unix `BROWSER` handling allows browser argument injection

RUSTSEC-2026-0257

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split_ascii_whitespace(). If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective BROWSER template contains %s, text that should remain within one URL argument becomes additional browser arguments.

The issue was reproduced with Chromium by injecting --remote-debugging-port, which exposed a local DevTools endpoint, and --proxy-server, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application.

Version 1.2.2 fixes the issue by tokenizing the BROWSER template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need HTTP(S) URLs can also enable the crate's hardened feature as defense in depth.

This issue was reported by @dywzju09-blip.