Deps.rs

denoland / deno

[![dependency status](https://deps.rs/repo/github/denoland/deno/status.svg)](https://deps.rs/repo/github/denoland/deno)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate deno_bench_util

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 bencher^0.10.1.5up to date
 tokio^1.10.11.12.0up to date

Crate deno

Dependencies

(41 total, 2 outdated)

CrateRequiredLatestStatus
 deno_ast^0.3.00.3.0up to date
 deno_doc^0.16.00.16.0up to date
 deno_graph^0.7.00.7.0up to date
 deno_lint^0.17.00.17.0up to date
 atty^0.2.140.2.14up to date
 base64^0.13.00.13.0up to date
 clap^2.33.32.33.3up to date
 data-url^0.1.00.1.0up to date
 dissimilar^1.0.21.0.3up to date
 dprint-plugin-json^0.13.00.13.0up to date
 dprint-plugin-markdown^0.10.00.11.0out of date
 dprint-plugin-typescript^0.57.30.57.3up to date
 encoding_rs^0.8.280.8.29up to date
 env_logger^0.8.40.9.0out of date
 fancy-regex^0.7.10.7.1up to date
 http^0.2.40.2.5up to date
 import_map^0.3.30.3.3up to date
 jsonc-parser^0.17.00.17.0up to date
 lazy_static^1.4.01.4.0up to date
 libc^0.2.1010.2.104up to date
 log^0.4.140.4.14up to date
 lspower^1.1.01.1.0up to date
 notify^5.0.0-pre.124.0.17up to date
 num_cpus^1.13.01.13.0up to date
 once_cell^1.8.01.8.0up to date
 percent-encoding^2.1.02.1.0up to date
 pin-project^1.0.81.0.8up to date
 rand^0.8.40.8.4up to date
 regex^1.5.41.5.4up to date
 ring^0.16.200.16.20up to date
 rustyline^9.0.09.0.0up to date
 rustyline-derive^0.5.00.5.0up to date
 semver-parser^0.10.20.10.2up to date
 serde^1.0.1291.0.130up to date
 shell-escape^0.1.50.1.5up to date
 sourcemap^6.0.16.0.1up to date
 tempfile^3.2.03.2.0up to date
 text-size^1.1.01.1.0up to date
 tokio^1.10.11.12.0up to date
 uuid^0.8.20.8.2up to date
 walkdir^2.3.22.3.2up to date

Dev dependencies

(6 total, 1 outdated)

CrateRequiredLatestStatus
 chrono^0.4.190.4.19up to date
 flaky_test^0.1.00.1.0up to date
 os_pipe^0.9.20.9.2up to date
 pretty_assertions^0.7.21.0.0out of date
 trust-dns-client^0.20.30.20.3up to date
 trust-dns-server^0.20.30.20.3up to date

Build dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 regex^1.5.41.5.4up to date
 serde^1.0.1291.0.130up to date

Crate deno_core

Dependencies

(12 total, 1 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.431.0.44up to date
 futures^0.3.160.3.17up to date
 indexmap=1.6.21.7.0out of date
 lazy_static^1.4.01.4.0up to date
 log^0.4.140.4.14up to date
 parking_lot^0.11.10.11.2up to date
 pin-project^1.0.71.0.8up to date
 rusty_v8^0.32.00.32.0up to date
 serde^1.0.1291.0.130up to date
 serde_json^1.0.661.0.68up to date
 serde_v8^0.15.00.15.0up to date
 url^2.2.22.2.2up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.10.11.12.0up to date

Crate deno_runtime

Dependencies

(18 total, all up-to-date)

CrateRequiredLatestStatus
 atty^0.2.140.2.14up to date
 dlopen^0.1.80.1.8up to date
 encoding_rs^0.8.280.8.29up to date
 filetime^0.2.150.2.15up to date
 fs3^0.5.00.5.0up to date
 http^0.2.40.2.5up to date
 hyper^0.14.120.14.13up to date
 lazy_static^1.4.01.4.0up to date
 libc^0.2.1010.2.104up to date
 log^0.4.140.4.14up to date
 notify=5.0.0-pre.124.0.17up to date
 regex^1.5.41.5.4up to date
 ring^0.16.200.16.20up to date
 serde^1.0.1291.0.130up to date
 sys-info^0.9.00.9.0up to date
 termcolor^1.1.21.1.2up to date
 tokio^1.10.11.12.0up to date
 uuid^0.8.20.8.2up to date

Crate test_ffi

No external dependencies! 🙌

Crate test_util

Dependencies

(15 total, 2 outdated)

CrateRequiredLatestStatus
 anyhow^1.0.431.0.44up to date
 async-stream^0.3.20.3.2up to date
 atty^0.2.140.2.14up to date
 base64^0.13.00.13.0up to date
 futures^0.3.160.3.17up to date
 hyper^0.14.120.14.13up to date
 lazy_static^1.4.01.4.0up to date
 os_pipe^0.9.20.9.2up to date
 regex^1.5.41.5.4up to date
 serde^1.0.1261.0.130up to date
 serde_json^1.0.651.0.68up to date
 tempfile^3.2.03.2.0up to date
 tokio^1.10.11.12.0up to date
 tokio-rustls^0.22.00.23.0out of date
 tokio-tungstenite^0.14.00.15.0out of date

Crate deno_broadcast_channel

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 async-trait^0.10.1.51up to date
 tokio^1.10.11.12.0up to date
 uuid^0.8.20.8.2up to date

Crate deno_console

No external dependencies! 🙌

Crate deno_crypto

Dependencies

(16 total, all up-to-date)

CrateRequiredLatestStatus
 aes^0.7.50.7.5up to date
 block-modes^0.8.10.8.1up to date
 elliptic-curve^0.10.60.10.6up to date
 lazy_static^1.4.01.4.0up to date
 num-traits^0.2.140.2.14up to date
 p256^0.9.00.9.0up to date
 p384^0.8.00.8.0up to date
 rand^0.8.40.8.4up to date
 ring^0.16.200.16.20up to date
 rsa^0.5.00.5.0up to date
 serde^1.0.1291.0.130up to date
 sha-1^0.9.70.9.8up to date
 sha2^0.9.50.9.8up to date
 spki^0.4.10.4.1up to date
 tokio^1.10.11.12.0up to date
 uuid^0.8.20.8.2up to date

Crate deno_fetch

Dependencies

(8 total, all up-to-date)

CrateRequiredLatestStatus
 bytes^1.1.01.1.0up to date
 data-url^0.1.00.1.0up to date
 http^0.2.40.2.5up to date
 reqwest^0.11.40.11.5up to date
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date
 tokio-stream^0.1.70.1.7up to date
 tokio-util^0.6.70.6.8up to date

Crate deno_ffi

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 dlopen^0.1.80.1.8up to date
 deno-libffi=0.0.70.0.7up to date
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date

Crate deno_http

Dependencies

(7 total, 1 possibly insecure)

CrateRequiredLatestStatus
 base64^0.13.00.13.0up to date
 bytes^11.1.0up to date
 hyper ⚠️^0.14.90.14.13maybe insecure
 ring^0.16.200.16.20up to date
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date
 tokio-util^0.6.70.6.8up to date

Crate deno_net

Dependencies

(5 total, all up-to-date)

CrateRequiredLatestStatus
 log^0.4.140.4.14up to date
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date
 trust-dns-proto^0.20.30.20.3up to date
 trust-dns-resolver^0.20.30.20.3up to date

Crate deno_timers

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tokio^1.10.11.12.0up to date

Crate deno_url

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.0.1291.0.130up to date
 serde_repr^0.1.70.1.7up to date
 urlpattern^0.1.20.1.2up to date

Crate deno_web

Dependencies

(6 total, all up-to-date)

CrateRequiredLatestStatus
 async-trait^0.1.510.1.51up to date
 base64^0.13.00.13.0up to date
 encoding_rs^0.8.280.8.29up to date
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date
 uuid^0.8.20.8.2up to date

Crate deno_webgpu

Dependencies

(4 total, 2 outdated)

CrateRequiredLatestStatus
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date
 wgpu-core^0.10.10.11.1out of date
 wgpu-types^0.10.00.11.0out of date

Crate deno_webidl

No external dependencies! 🙌

Crate deno_websocket

Dependencies

(6 total, 2 outdated)

CrateRequiredLatestStatus
 http^0.2.40.2.5up to date
 hyper^0.14.120.14.13up to date
 serde^1.0.1291.0.130up to date
 tokio^1.10.11.12.0up to date
 tokio-rustls^0.22.00.23.0out of date
 tokio-tungstenite^0.14.00.15.0out of date

Crate deno_webstorage

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 rusqlite^0.25.30.26.0out of date
 serde^1.0.1291.0.130up to date

Crate deno_tls

Dependencies

(7 total, 3 outdated)

CrateRequiredLatestStatus
 lazy_static^1.4.01.4.0up to date
 reqwest^0.11.40.11.5up to date
 rustls^0.19.10.20.0out of date
 rustls-native-certs^0.5.00.5.0up to date
 serde^1.0.1291.0.130up to date
 webpki^0.21.40.22.0out of date
 webpki-roots^0.21.10.22.1out of date

Security Vulnerabilities

hyper: Lenient `hyper` header parsing of `Content-Length` could allow request smuggling

RUSTSEC-2021-0078

hyper's HTTP header parser accepted, according to RFC 7230, illegal contents inside Content-Length headers. Due to this, upstream HTTP proxies that ignore the header may still forward them along if it chooses to ignore the error.

To be vulnerable, hyper must be used as an HTTP/1 server and using an HTTP proxy upstream that ignores the header's contents but still forwards it. Due to all the factors that must line up, an attack exploiting this vulnerability is unlikely.

hyper: Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss

RUSTSEC-2021-0079

When decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation, this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.

To be vulnerable, you must be using hyper for any HTTP/1 purpose, including as a client or server, and consumers must send requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible, any upstream proxies must accept a chunk size greater than 64 bits.