Deps.rs

denoland / deno

[![dependency status](https://deps.rs/repo/github/denoland/deno/status.svg)](https://deps.rs/repo/github/denoland/deno)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate deno_bench_util

Dependencies

(2 total, 1 possibly insecure)

CrateRequiredLatestStatus
 bencher^0.10.1.5up to date
 tokio ⚠️^1.10.11.15.0maybe insecure

Crate deno

Dependencies

(47 total, 15 outdated, 1 insecure)

CrateRequiredLatestStatus
 deno_ast^0.9.00.9.0up to date
 deno_doc^0.26.00.26.1up to date
 deno_graph^0.18.00.18.0up to date
 deno_lint^0.22.00.22.0up to date
 atty=0.2.140.2.14up to date
 base64=0.13.00.13.0up to date
 cache_control=0.2.00.2.0up to date
 chrono ⚠️=0.4.190.4.19insecure
 clap=3.0.73.0.10out of date
 clap_complete=3.0.33.0.4out of date
 clap_complete_fig=3.0.23.0.2up to date
 data-url=0.1.10.1.1up to date
 dissimilar=1.0.21.0.3out of date
 dprint-plugin-json=0.14.00.14.0up to date
 dprint-plugin-markdown=0.12.00.12.0up to date
 dprint-plugin-typescript=0.62.00.62.0up to date
 encoding_rs=0.8.290.8.30out of date
 env_logger=0.8.40.9.0out of date
 fancy-regex=0.7.10.7.1up to date
 http=0.2.40.2.6out of date
 import_map=0.6.00.6.0up to date
 jsonc-parser=0.17.10.18.0out of date
 libc=0.2.1060.2.112out of date
 log=0.4.140.4.14up to date
 lspower=1.4.01.5.0out of date
 notify=5.0.0-pre.124.0.17up to date
 num_cpus=1.13.01.13.1out of date
 once_cell=1.9.01.9.0up to date
 percent-encoding=2.1.02.1.0up to date
 pin-project=1.0.81.0.10out of date
 rand=0.8.40.8.4up to date
 regex=1.5.41.5.4up to date
 ring=0.16.200.16.20up to date
 rustyline=9.0.09.1.2out of date
 rustyline-derive=0.5.00.6.0out of date
 semver-parser=0.10.20.10.2up to date
 serde=1.0.1331.0.133up to date
 shell-escape=0.1.50.1.5up to date
 sourcemap=6.0.16.0.1up to date
 tempfile=3.2.03.3.0out of date
 text-size=1.1.01.1.0up to date
 text_lines=0.4.10.4.1up to date
 tokio=1.141.15.0out of date
 typed-arena^2.0.12.0.1up to date
 uuid=0.8.20.8.2up to date
 walkdir=2.3.22.3.2up to date
 zstd=0.9.20.9.2+zstd.1.5.1up to date

Dev dependencies

(5 total, 2 outdated)

CrateRequiredLatestStatus
 flaky_test=0.1.00.1.0up to date
 os_pipe=0.9.21.0.0out of date
 pretty_assertions=0.7.21.0.0out of date
 trust-dns-client=0.20.30.20.3up to date
 trust-dns-server=0.20.30.20.3up to date

Build dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 regex=1.5.41.5.4up to date
 serde=1.0.1331.0.133up to date
 zstd=0.9.20.9.2+zstd.1.5.1up to date

Crate deno_core

Dependencies

(12 total, all up-to-date)

CrateRequiredLatestStatus
 anyhow^1.0.431.0.52up to date
 futures^0.3.160.3.19up to date
 indexmap^1.7.01.8.0up to date
 libc^0.2.1060.2.112up to date
 log^0.4.140.4.14up to date
 once_cell=1.9.01.9.0up to date
 parking_lot^0.11.10.11.2up to date
 pin-project^1.0.71.0.10up to date
 serde^1.0.1291.0.133up to date
 serde_json^1.0.661.0.75up to date
 url^2.2.22.2.2up to date
 v8^0.37.00.37.0up to date

Dev dependencies

(1 total, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^1.10.11.15.0maybe insecure

Crate deno_runtime

Dependencies

(21 total, 1 possibly insecure)

CrateRequiredLatestStatus
 atty^0.2.140.2.14up to date
 dlopen^0.1.80.1.8up to date
 encoding_rs^0.8.290.8.30up to date
 filetime^0.2.150.2.15up to date
 fs3^0.5.00.5.0up to date
 http^0.2.40.2.6up to date
 hyper^0.14.120.14.16up to date
 libc^0.2.1060.2.112up to date
 log^0.4.140.4.14up to date
 lzzzz=0.8.00.8.0up to date
 netif^0.1.00.1.1up to date
 notify=5.0.0-pre.124.0.17up to date
 once_cell=1.9.01.9.0up to date
 regex^1.5.41.5.4up to date
 ring^0.16.200.16.20up to date
 serde^1.0.1291.0.133up to date
 signal-hook-registry^1.4.01.4.0up to date
 sys-info^0.9.00.9.1up to date
 termcolor^1.1.21.1.2up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 uuid^0.8.20.8.2up to date

Build dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 lzzzz=0.8.00.8.0up to date

Crate serde_v8

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.0.1301.0.133up to date
 serde_bytes^0.110.11.5up to date
 v8^0.37.00.37.0up to date

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 bencher^0.10.1.5up to date
 serde_json^1.0.641.0.75up to date

Crate test_ffi

No external dependencies! 🙌

Crate test_util

Dependencies

(16 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 anyhow^1.0.431.0.52up to date
 async-stream^0.3.20.3.2up to date
 atty^0.2.140.2.14up to date
 base64^0.13.00.13.0up to date
 futures^0.3.160.3.19up to date
 hyper^0.14.120.14.16up to date
 lazy_static^1.4.01.4.0up to date
 os_pipe^0.9.21.0.0out of date
 regex^1.5.41.5.4up to date
 rustls-pemfile^0.2.10.2.1up to date
 serde^1.0.1261.0.133up to date
 serde_json^1.0.651.0.75up to date
 tempfile^3.2.03.3.0up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 tokio-rustls^0.230.23.2up to date
 tokio-tungstenite^0.160.16.1up to date

Crate deno_broadcast_channel

Dependencies

(3 total, 1 possibly insecure)

CrateRequiredLatestStatus
 async-trait^0.10.1.52up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate deno_console

No external dependencies! 🙌

Crate deno_crypto

Dependencies

(21 total, 6 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 aes^0.7.50.7.5up to date
 aes-gcm^0.9.40.9.4up to date
 aes-kw^0.10.1.0up to date
 base64^0.13.00.13.0up to date
 block-modes^0.8.10.8.1up to date
 ctr^0.8.00.8.0up to date
 elliptic-curve^0.10.60.11.9out of date
 num-traits^0.2.140.2.14up to date
 once_cell=1.9.01.9.0up to date
 p256^0.9.00.10.1out of date
 p384^0.8.00.9.0out of date
 rand^0.8.40.8.4up to date
 ring^0.16.200.16.20up to date
 rsa^0.5.00.5.0up to date
 serde^1.0.1291.0.133up to date
 serde_bytes^0.110.11.5up to date
 sha-1^0.9.70.10.0out of date
 sha2^0.9.50.10.1out of date
 spki^0.4.10.5.4out of date
 tokio ⚠️^1.10.11.15.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate deno_fetch

Dependencies

(9 total, 1 possibly insecure)

CrateRequiredLatestStatus
 bytes^1.1.01.1.0up to date
 data-url^0.1.00.1.1up to date
 dyn-clone^11.0.4up to date
 http^0.2.40.2.6up to date
 reqwest^0.11.70.11.9up to date
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 tokio-stream^0.1.70.1.8up to date
 tokio-util^0.6.70.6.9up to date

Crate deno_ffi

Dependencies

(4 total, 1 possibly insecure)

CrateRequiredLatestStatus
 dlopen^0.1.80.1.8up to date
 libffi^2.0.02.0.0up to date
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure

Crate deno_http

Dependencies

(7 total, 2 possibly insecure)

CrateRequiredLatestStatus
 base64^0.13.00.13.0up to date
 bytes^11.1.0up to date
 hyper ⚠️^0.14.90.14.16maybe insecure
 ring^0.16.200.16.20up to date
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 tokio-util^0.6.70.6.9up to date

Crate deno_net

Dependencies

(5 total, 1 possibly insecure)

CrateRequiredLatestStatus
 log^0.4.140.4.14up to date
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 trust-dns-proto^0.20.30.20.3up to date
 trust-dns-resolver^0.20.30.20.3up to date

Crate deno_timers

Dependencies

(1 total, 1 possibly insecure)

CrateRequiredLatestStatus
 tokio ⚠️^1.10.11.15.0maybe insecure

Crate deno_url

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.0.1291.0.133up to date
 serde_repr^0.1.70.1.7up to date
 urlpattern^0.1.30.1.4up to date

Crate deno_web

Dependencies

(6 total, 1 possibly insecure)

CrateRequiredLatestStatus
 async-trait^0.1.510.1.52up to date
 base64^0.13.00.13.0up to date
 encoding_rs^0.8.290.8.30up to date
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 uuid^0.8.20.8.2up to date

Crate deno_webgpu

Dependencies

(4 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 wgpu-core^0.10.10.12.2out of date
 wgpu-types^0.10.00.12.0out of date

Crate deno_webidl

No external dependencies! 🙌

Crate deno_websocket

Dependencies

(6 total, 1 possibly insecure)

CrateRequiredLatestStatus
 http^0.2.40.2.6up to date
 hyper^0.14.120.14.16up to date
 serde^1.0.1291.0.133up to date
 tokio ⚠️^1.10.11.15.0maybe insecure
 tokio-rustls^0.23.00.23.2up to date
 tokio-tungstenite^0.16.00.16.1up to date

Crate deno_webstorage

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 rusqlite^0.25.30.26.3out of date
 serde^1.0.1291.0.133up to date

Crate deno_tls

Dependencies

(7 total, all up-to-date)

CrateRequiredLatestStatus
 once_cell=1.9.01.9.0up to date
 rustls^0.200.20.2up to date
 rustls-native-certs^0.6.10.6.1up to date
 rustls-pemfile^0.2.10.2.1up to date
 serde^1.0.1291.0.133up to date
 webpki^0.220.22.0up to date
 webpki-roots^0.220.22.2up to date

Security Vulnerabilities

chrono: Potential segfault in `localtime_r` invocations

RUSTSEC-2020-0159

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

hyper: Lenient `hyper` header parsing of `Content-Length` could allow request smuggling

RUSTSEC-2021-0078

hyper's HTTP header parser accepted, according to RFC 7230, illegal contents inside Content-Length headers. Due to this, upstream HTTP proxies that ignore the header may still forward them along if it chooses to ignore the error.

To be vulnerable, hyper must be used as an HTTP/1 server and using an HTTP proxy upstream that ignores the header's contents but still forwards it. Due to all the factors that must line up, an attack exploiting this vulnerability is unlikely.

hyper: Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss

RUSTSEC-2021-0079

When decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation, this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.

To be vulnerable, you must be using hyper for any HTTP/1 purpose, including as a client or server, and consumers must send requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible, any upstream proxies must accept a chunk size greater than 64 bits.

tokio: Data race when sending and receiving after closing a `oneshot` channel

RUSTSEC-2021-0124

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.

See tokio#4225 for more details.