Deps.rs

mozilla / neqo

[![dependency status](https://deps.rs/repo/github/mozilla/neqo/status.svg)](https://deps.rs/repo/github/mozilla/neqo)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate fuzz

No external dependencies! 🙌

Crate neqo-bin

Dependencies

(7 total, 1 possibly insecure)

CrateRequiredLatestStatus
 clap^4.44.5.4up to date
 clap-verbosity-flag^2.22.2.0up to date
 futures^0.30.3.30up to date
 hex^0.40.4.3up to date
 regex^1.91.10.4up to date
 tokio ⚠️^11.37.0maybe insecure
 url^2.52.5.0up to date

Dev dependencies

(2 total, 1 possibly insecure)

CrateRequiredLatestStatus
 criterion^0.50.5.1up to date
 tokio ⚠️^11.37.0maybe insecure

Crate neqo-common

Dependencies

(4 total, 1 outdated)

CrateRequiredLatestStatus
 enum-map^2.72.7.3up to date
 env_logger^0.100.11.3out of date
 hex^0.40.4.3up to date
 time^0.30.3.36up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 criterion^0.50.5.1up to date

Crate neqo-crypto

Build dependencies

(6 total, 1 outdated)

CrateRequiredLatestStatus
 bindgen^0.690.69.4up to date
 mozbuild^0.10.1.0up to date
 semver^1.01.0.22up to date
 serde^1.01.0.198up to date
 serde_derive^1.01.0.198up to date
 toml^0.50.8.12out of date

Crate neqo-http3

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 enumset^1.11.1.3up to date
 sfv^0.90.9.4up to date
 smallvec^1.111.13.2up to date
 url^2.52.5.0up to date

Crate neqo-qpack

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 static_assertions^1.11.1.0up to date

Crate neqo-transport

Dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 enum-map^2.72.7.3up to date
 indexmap^1.92.2.6out of date
 smallvec^1.111.13.2up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 criterion^0.50.5.1up to date

Crate test-fixture

No external dependencies! 🙌

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);