This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate deno_bench_util

Dependencies

(2 total, 1 possibly insecure)

CrateRequiredLatestStatus
 bencher^0.10.1.5up to date
 tokio ⚠️^1.10.11.14.0maybe insecure

Crate deno

Dependencies

(41 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 deno_ast^0.5.00.5.0up to date
 deno_doc^0.21.00.21.0up to date
 deno_graph^0.12.00.12.0up to date
 deno_lint^0.19.00.19.0up to date
 atty^0.2.140.2.14up to date
 base64^0.13.00.13.0up to date
 clap^2.33.32.33.3up to date
 data-url^0.1.00.1.1up to date
 dissimilar^1.0.21.0.3up to date
 dprint-plugin-json^0.13.20.13.2up to date
 dprint-plugin-markdown^0.11.30.11.3up to date
 dprint-plugin-typescript^0.59.20.59.2up to date
 encoding_rs^0.8.290.8.29up to date
 env_logger^0.8.40.9.0out of date
 fancy-regex^0.7.10.7.1up to date
 http^0.2.40.2.5up to date
 import_map^0.3.30.4.0out of date
 jsonc-parser^0.17.00.17.0up to date
 lazy_static^1.4.01.4.0up to date
 libc^0.2.1060.2.108up to date
 log^0.4.140.4.14up to date
 lspower^1.4.01.4.0up to date
 notify^5.0.0-pre.124.0.17up to date
 num_cpus^1.13.01.13.0up to date
 once_cell^1.8.01.8.0up to date
 percent-encoding^2.1.02.1.0up to date
 pin-project^1.0.81.0.8up to date
 rand^0.8.40.8.4up to date
 regex^1.5.41.5.4up to date
 ring^0.16.200.16.20up to date
 rustyline^9.0.09.0.0up to date
 rustyline-derive^0.5.00.5.0up to date
 semver-parser^0.10.20.10.2up to date
 serde^1.0.1291.0.130up to date
 shell-escape^0.1.50.1.5up to date
 sourcemap^6.0.16.0.1up to date
 tempfile^3.2.03.2.0up to date
 text-size^1.1.01.1.0up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 uuid^0.8.20.8.2up to date
 walkdir^2.3.22.3.2up to date

Dev dependencies

(6 total, 2 outdated, 1 insecure)

CrateRequiredLatestStatus
 chrono ⚠️^0.4.190.4.19insecure
 flaky_test^0.1.00.1.0up to date
 os_pipe^0.9.21.0.0out of date
 pretty_assertions^0.7.21.0.0out of date
 trust-dns-client^0.20.30.20.3up to date
 trust-dns-server^0.20.30.20.3up to date

Build dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 regex^1.5.41.5.4up to date
 serde^1.0.1291.0.130up to date

Crate deno_core

Dependencies

(12 total, 1 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.431.0.49up to date
 futures^0.3.160.3.18up to date
 indexmap=1.6.21.7.0out of date
 lazy_static^1.4.01.4.0up to date
 libc^0.2.1060.2.108up to date
 log^0.4.140.4.14up to date
 parking_lot^0.11.10.11.2up to date
 pin-project^1.0.71.0.8up to date
 serde^1.0.1291.0.130up to date
 serde_json^1.0.661.0.72up to date
 url^2.2.22.2.2up to date
 v8^0.35.00.35.0up to date

Dev dependencies

(1 total, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^1.10.11.14.0maybe insecure

Crate deno_runtime

Dependencies

(18 total, 1 possibly insecure)

CrateRequiredLatestStatus
 atty^0.2.140.2.14up to date
 dlopen^0.1.80.1.8up to date
 encoding_rs^0.8.290.8.29up to date
 filetime^0.2.150.2.15up to date
 fs3^0.5.00.5.0up to date
 http^0.2.40.2.5up to date
 hyper^0.14.120.14.15up to date
 lazy_static^1.4.01.4.0up to date
 libc^0.2.1060.2.108up to date
 log^0.4.140.4.14up to date
 notify=5.0.0-pre.124.0.17up to date
 regex^1.5.41.5.4up to date
 ring^0.16.200.16.20up to date
 serde^1.0.1291.0.130up to date
 sys-info^0.9.00.9.1up to date
 termcolor^1.1.21.1.2up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate serde_v8

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.0.1301.0.130up to date
 serde_bytes^0.110.11.5up to date
 v8^0.35.00.35.0up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 bencher^0.10.1.5up to date
 serde_json^1.0.641.0.72up to date

Crate test_ffi

No external dependencies! 🙌

Crate test_util

Dependencies

(15 total, 3 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.0.431.0.49up to date
 async-stream^0.3.20.3.2up to date
 atty^0.2.140.2.14up to date
 base64^0.13.00.13.0up to date
 futures^0.3.160.3.18up to date
 hyper^0.14.120.14.15up to date
 lazy_static^1.4.01.4.0up to date
 os_pipe^0.9.21.0.0out of date
 regex^1.5.41.5.4up to date
 serde^1.0.1261.0.130up to date
 serde_json^1.0.651.0.72up to date
 tempfile^3.2.03.2.0up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 tokio-rustls^0.22.00.23.1out of date
 tokio-tungstenite^0.14.00.16.0out of date

Crate deno_broadcast_channel

Dependencies

(3 total, 1 possibly insecure)

CrateRequiredLatestStatus
 async-trait^0.10.1.51up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate deno_console

No external dependencies! 🙌

Crate deno_crypto

Dependencies

(16 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 aes^0.7.50.7.5up to date
 block-modes^0.8.10.8.1up to date
 elliptic-curve^0.10.60.11.1out of date
 lazy_static^1.4.01.4.0up to date
 num-traits^0.2.140.2.14up to date
 p256^0.9.00.9.0up to date
 p384^0.8.00.8.0up to date
 rand^0.8.40.8.4up to date
 ring^0.16.200.16.20up to date
 rsa^0.5.00.5.0up to date
 serde^1.0.1291.0.130up to date
 sha-1^0.9.70.9.8up to date
 sha2^0.9.50.9.8up to date
 spki^0.4.10.5.2out of date
 tokio ⚠️^1.10.11.14.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate deno_fetch

Dependencies

(8 total, 1 possibly insecure)

CrateRequiredLatestStatus
 bytes^1.1.01.1.0up to date
 data-url^0.1.00.1.1up to date
 http^0.2.40.2.5up to date
 reqwest^0.11.40.11.6up to date
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 tokio-stream^0.1.70.1.8up to date
 tokio-util^0.6.70.6.9up to date

Crate deno_ffi

Dependencies

(4 total, 1 possibly insecure)

CrateRequiredLatestStatus
 dlopen^0.1.80.1.8up to date
 libffi^2.0.02.0.0up to date
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure

Crate deno_http

Dependencies

(7 total, 2 possibly insecure)

CrateRequiredLatestStatus
 base64^0.13.00.13.0up to date
 bytes^11.1.0up to date
 hyper ⚠️^0.14.90.14.15maybe insecure
 ring^0.16.200.16.20up to date
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 tokio-util^0.6.70.6.9up to date

Crate deno_net

Dependencies

(5 total, 1 possibly insecure)

CrateRequiredLatestStatus
 log^0.4.140.4.14up to date
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 trust-dns-proto^0.20.30.20.3up to date
 trust-dns-resolver^0.20.30.20.3up to date

Crate deno_timers

Dependencies

(1 total, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^1.10.11.14.0maybe insecure

Crate deno_url

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.0.1291.0.130up to date
 serde_repr^0.1.70.1.7up to date
 urlpattern^0.1.20.1.2up to date

Crate deno_web

Dependencies

(6 total, 1 possibly insecure)

CrateRequiredLatestStatus
 async-trait^0.1.510.1.51up to date
 base64^0.13.00.13.0up to date
 encoding_rs^0.8.290.8.29up to date
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate deno_webgpu

Dependencies

(4 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 wgpu-core^0.10.10.11.2out of date
 wgpu-types^0.10.00.11.0out of date

Crate deno_webidl

No external dependencies! 🙌

Crate deno_websocket

Dependencies

(6 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 http^0.2.40.2.5up to date
 hyper^0.14.120.14.15up to date
 serde^1.0.1291.0.130up to date
 tokio ⚠️^1.10.11.14.0maybe insecure
 tokio-rustls^0.22.00.23.1out of date
 tokio-tungstenite^0.14.00.16.0out of date

Crate deno_webstorage

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 rusqlite^0.25.30.26.1out of date
 serde^1.0.1291.0.130up to date

Crate deno_tls

Dependencies

(7 total, 4 outdated)

CrateRequiredLatestStatus
 lazy_static^1.4.01.4.0up to date
 reqwest^0.11.40.11.6up to date
 rustls^0.19.10.20.2out of date
 rustls-native-certs^0.5.00.6.1out of date
 serde^1.0.1291.0.130up to date
 webpki^0.21.40.22.0out of date
 webpki-roots^0.21.10.22.1out of date

Security Vulnerabilities

chrono: Potential segfault in `localtime_r` invocations

RUSTSEC-2020-0159

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

hyper: Lenient `hyper` header parsing of `Content-Length` could allow request smuggling

RUSTSEC-2021-0078

hyper's HTTP header parser accepted, according to RFC 7230, illegal contents inside Content-Length headers. Due to this, upstream HTTP proxies that ignore the header may still forward them along if it chooses to ignore the error.

To be vulnerable, hyper must be used as an HTTP/1 server and using an HTTP proxy upstream that ignores the header's contents but still forwards it. Due to all the factors that must line up, an attack exploiting this vulnerability is unlikely.

hyper: Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss

RUSTSEC-2021-0079

When decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation, this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.

To be vulnerable, you must be using hyper for any HTTP/1 purpose, including as a client or server, and consumers must send requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible, any upstream proxies must accept a chunk size greater than 64 bits.

tokio: Data race when sending and receiving after closing a `oneshot` channel

RUSTSEC-2021-0124

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.

See tokio#4225 for more details.