This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
activity_indicatorNo external dependencies! 🙌
agentNo external dependencies! 🙌
anthropicNo external dependencies! 🙌
askpassNo external dependencies! 🙌
assetsNo external dependencies! 🙌
assistantNo external dependencies! 🙌
assistant_context_editorNo external dependencies! 🙌
assistant_settingsNo external dependencies! 🙌
assistant_slash_commandNo external dependencies! 🙌
assistant_slash_commandsNo external dependencies! 🙌
assistant_toolNo external dependencies! 🙌
assistant_toolsNo external dependencies! 🙌
audio(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| rodio | ^0.20.0 | 0.20.1 | up to date |
auto_updateNo external dependencies! 🙌
auto_update_helperNo external dependencies! 🙌
auto_update_uiNo external dependencies! 🙌
aws_http_clientNo external dependencies! 🙌
bedrockNo external dependencies! 🙌
breadcrumbsNo external dependencies! 🙌
buffer_diffNo external dependencies! 🙌
callNo external dependencies! 🙌
channelNo external dependencies! 🙌
cli(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| ipc-channel | ^0.19 | 0.19.0 | up to date |
client(3 total, 2 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| async-recursion | ^0.3 | 1.1.1 | out of date |
| tiny_http | ^0.8 | 0.12.0 | out of date |
| tokio-socks | ^0.5.2 | 0.5.2 | up to date |
clockNo external dependencies! 🙌
collab(14 total, 4 outdated, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| aws-config | ^1.1.5 | 1.6.2 | up to date |
| aws-sdk-s3 | ^1.15.0 | 1.83.0 | up to date |
| aws-sdk-kinesis | ^1.51.0 | 1.67.0 | up to date |
| axum | ^0.6 | 0.8.3 | out of date |
| axum-extra | ^0.4 | 0.10.1 | out of date |
| envy | ^0.4.2 | 0.4.2 | up to date |
| prometheus | ^0.14 | 0.14.0 | up to date |
| reqwest | ^0.11 | 0.12.15 | out of date |
| scrypt | ^0.11 | 0.11.0 | up to date |
| sea-orm | ^1.1.0-rc.1 | 1.1.10 | up to date |
| sqlx ⚠️ | ^0.8 | 0.8.5 | maybe insecure |
| tower | ^0.4 | 0.5.2 | out of date |
| tracing | ^0.1.40 | 0.1.41 | up to date |
| tracing-subscriber | ^0.3.18 | 0.3.19 | up to date |
(2 total, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| sea-orm | ^1.1.0-rc.1 | 1.1.10 | up to date |
| sqlx ⚠️ | ^0.8 | 0.8.5 | maybe insecure |
collab_uiNo external dependencies! 🙌
collectionsNo external dependencies! 🙌
command_paletteNo external dependencies! 🙌
command_palette_hooksNo external dependencies! 🙌
componentNo external dependencies! 🙌
component_previewNo external dependencies! 🙌
context_serverNo external dependencies! 🙌
context_server_settingsNo external dependencies! 🙌
copilotNo external dependencies! 🙌
credentials_providerNo external dependencies! 🙌
dapNo external dependencies! 🙌
dap_adaptersNo external dependencies! 🙌
dbNo external dependencies! 🙌
debugger_toolsNo external dependencies! 🙌
debugger_uiNo external dependencies! 🙌
deepseekNo external dependencies! 🙌
diagnosticsNo external dependencies! 🙌
docs_preprocessor(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| mdbook | ^0.4.40 | 0.4.48 | up to date |
editorNo external dependencies! 🙌
evalNo external dependencies! 🙌
extensionNo external dependencies! 🙌
zed_extension_api(3 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| serde | ^1.0 | 1.0.219 | up to date |
| serde_json | ^1.0 | 1.0.140 | up to date |
| wit-bindgen | ^0.41 | 0.41.0 | up to date |
extension_cliNo external dependencies! 🙌
extension_hostNo external dependencies! 🙌
extensions_uiNo external dependencies! 🙌
feature_flagsNo external dependencies! 🙌
feedback(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| human_bytes | ^0.4.1 | 0.4.3 | up to date |
file_finderNo external dependencies! 🙌
file_iconsNo external dependencies! 🙌
fsNo external dependencies! 🙌
fseventNo external dependencies! 🙌
fuzzyNo external dependencies! 🙌
gitNo external dependencies! 🙌
git_hosting_providersNo external dependencies! 🙌
git_uiNo external dependencies! 🙌
go_to_lineNo external dependencies! 🙌
google_aiNo external dependencies! 🙌
gpui(14 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| async-task | ^4.7 | 4.7.1 | up to date |
| backtrace | ^0.3 | 0.3.74 | up to date |
| bytemuck | ^1 | 1.22.0 | up to date |
| etagere | ^0.2 | 0.2.15 | up to date |
| num_cpus | ^1.13 | 1.16.0 | up to date |
| parking | ^2.0.0 | 2.2.1 | up to date |
| raw-window-handle | ^0.6 | 0.6.2 | up to date |
| resvg | ^0.45.0 | 0.45.1 | up to date |
| usvg | ^0.45.0 | 0.45.1 | up to date |
| seahash | ^4.1 | 4.1.0 | up to date |
| slotmap | ^1.0.6 | 1.0.7 | up to date |
| taffy | ^0.4.3 | 0.8.1 | out of date |
| waker-fn | ^1.2.0 | 1.2.0 | up to date |
| lyon | ^1.0 | 1.0.1 | up to date |
(2 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| backtrace | ^0.3 | 0.3.74 | up to date |
| lyon | ^1.0 | 1.0.1 | up to date |
gpui_macrosNo external dependencies! 🙌
gpui_tokioNo external dependencies! 🙌
html_to_markdownNo external dependencies! 🙌
http_clientNo external dependencies! 🙌
http_client_tlsNo external dependencies! 🙌
iconsNo external dependencies! 🙌
image_viewerNo external dependencies! 🙌
indexed_docsNo external dependencies! 🙌
inline_completionNo external dependencies! 🙌
inline_completion_buttonNo external dependencies! 🙌
install_cliNo external dependencies! 🙌
journalNo external dependencies! 🙌
language(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| unicase | ^2.6 | 2.8.1 | up to date |
language_extensionNo external dependencies! 🙌
language_modelNo external dependencies! 🙌
language_model_selectorNo external dependencies! 🙌
language_modelsNo external dependencies! 🙌
language_selectorNo external dependencies! 🙌
language_toolsNo external dependencies! 🙌
languagesNo external dependencies! 🙌
livekit_apiNo external dependencies! 🙌
livekit_client(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| cpal | ^0.15 | 0.15.3 | up to date |
lmstudioNo external dependencies! 🙌
lspNo external dependencies! 🙌
markdownNo external dependencies! 🙌
markdown_previewNo external dependencies! 🙌
media(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| bindgen | ^0.71 | 0.71.1 | up to date |
menuNo external dependencies! 🙌
migratorNo external dependencies! 🙌
mistralNo external dependencies! 🙌
multi_bufferNo external dependencies! 🙌
node_runtime(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| walkdir | ^2.5.0 | 2.5.0 | up to date |
notificationsNo external dependencies! 🙌
ollamaNo external dependencies! 🙌
open_aiNo external dependencies! 🙌
outlineNo external dependencies! 🙌
outline_panelNo external dependencies! 🙌
panelNo external dependencies! 🙌
pathsNo external dependencies! 🙌
pickerNo external dependencies! 🙌
prettierNo external dependencies! 🙌
projectNo external dependencies! 🙌
project_panelNo external dependencies! 🙌
project_symbolsNo external dependencies! 🙌
prompt_storeNo external dependencies! 🙌
protoNo external dependencies! 🙌
recent_projectsNo external dependencies! 🙌
refineableNo external dependencies! 🙌
derive_refineableNo external dependencies! 🙌
release_channelNo external dependencies! 🙌
remoteNo external dependencies! 🙌
remote_server(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| backtrace | ^0.3 | 0.3.74 | up to date |
replNo external dependencies! 🙌
reqwest_clientNo external dependencies! 🙌
rich_textNo external dependencies! 🙌
rope(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| arrayvec | ^0.7.1 | 0.7.6 | up to date |
(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| criterion | ^0.5 | 0.5.1 | up to date |
rpc(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| tracing | ^0.1.34 | 0.1.41 | up to date |
rules_libraryNo external dependencies! 🙌
schema_generatorNo external dependencies! 🙌
searchNo external dependencies! 🙌
semantic_indexNo external dependencies! 🙌
semantic_versionNo external dependencies! 🙌
sessionNo external dependencies! 🙌
settingsNo external dependencies! 🙌
settings_uiNo external dependencies! 🙌
snippetNo external dependencies! 🙌
snippet_providerNo external dependencies! 🙌
snippets_uiNo external dependencies! 🙌
sqlez(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| thread_local | ^1.1.4 | 1.1.8 | up to date |
sqlez_macrosNo external dependencies! 🙌
storyNo external dependencies! 🙌
storybook(2 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| ctrlc | ^3.4 | 3.4.6 | up to date |
| dialoguer | ^0.11.0 | 0.11.0 | up to date |
streaming_diffNo external dependencies! 🙌
sum_tree(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| arrayvec | ^0.7.1 | 0.7.6 | up to date |
supermavenNo external dependencies! 🙌
supermaven_apiNo external dependencies! 🙌
tab_switcherNo external dependencies! 🙌
taskNo external dependencies! 🙌
tasks_uiNo external dependencies! 🙌
telemetryNo external dependencies! 🙌
telemetry_eventsNo external dependencies! 🙌
terminalNo external dependencies! 🙌
terminal_viewNo external dependencies! 🙌
textNo external dependencies! 🙌
themeNo external dependencies! 🙌
theme_extensionNo external dependencies! 🙌
theme_importer(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| vscode_theme | ^0.2.0 | 0.2.0 | up to date |
theme_selectorNo external dependencies! 🙌
time_formatNo external dependencies! 🙌
title_barNo external dependencies! 🙌
toolchain_selectorNo external dependencies! 🙌
ui(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| documented | ^0.9.1 | 0.9.1 | up to date |
ui_inputNo external dependencies! 🙌
ui_macrosNo external dependencies! 🙌
ui_promptNo external dependencies! 🙌
utilNo external dependencies! 🙌
util_macrosNo external dependencies! 🙌
vim(1 total, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| tokio ⚠️ | ^1.15 | 1.44.2 | maybe insecure |
vim_mode_settingNo external dependencies! 🙌
web_searchNo external dependencies! 🙌
web_search_providersNo external dependencies! 🙌
welcomeNo external dependencies! 🙌
workspace(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| bincode | ^1.2.1 | 2.0.1 | out of date |
worktreeNo external dependencies! 🙌
zed(2 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| backtrace | ^0.3 | 0.3.74 | up to date |
| mimalloc | ^0.1 | 0.1.46 | up to date |
zed_actionsNo external dependencies! 🙌
zetaNo external dependencies! 🙌
zlogNo external dependencies! 🙌
zlog_settingsNo external dependencies! 🙌
zed_emmet(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
zed_glsl(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
zed_html(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
perplexity(1 total, all up-to-date)
| Crate | Required | Latest | Status |
|---|---|---|---|
| serde | ^1 | 1.0.219 | up to date |
zed_proto(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
zed_ruff(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
slash_commands_example(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
zed_snippets(2 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
| serde_json | ^1.0 | 1.0.140 | up to date |
zed_test_extensionNo external dependencies! 🙌
zed_toml(1 total, 1 outdated)
| Crate | Required | Latest | Status |
|---|---|---|---|
| zed_extension_api | ^0.1.0 | 0.4.0 | out of date |
workspace-hack(106 total, 17 outdated, 8 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| aho-corasick | ^1 | 1.1.3 | up to date |
| anstream | ^0.6 | 0.6.18 | up to date |
| arrayvec | ^0.7 | 0.7.6 | up to date |
| async-compression | ^0.4 | 0.4.23 | up to date |
| async-std | ^1 | 1.13.1 | up to date |
| async-tungstenite | ^0.29 | 0.29.1 | up to date |
| aws-config | ^1 | 1.6.2 | up to date |
| aws-credential-types | ^1 | 1.2.3 | up to date |
| aws-runtime | ^1 | 1.5.7 | up to date |
| aws-sigv4 | ^1 | 1.3.1 | up to date |
| aws-smithy-async | ^1 | 1.2.5 | up to date |
| aws-smithy-http | ^0.62 | 0.62.1 | up to date |
| aws-smithy-runtime | ^1 | 1.8.3 | up to date |
| aws-smithy-runtime-api | ^1 | 1.8.0 | up to date |
| aws-smithy-types | ^1 | 1.3.1 | up to date |
| base64 | ^0.22 | 0.22.1 | up to date |
| base64ct | ^1 | 1.7.3 | up to date |
| bigdecimal | ^0.4 | 0.4.8 | up to date |
| bit-set | ^0.8 | 0.8.0 | up to date |
| bitflags | ^2 | 2.9.0 | up to date |
| bstr | ^1 | 1.12.0 | up to date |
| bytemuck | ^1 | 1.22.0 | up to date |
| byteorder | ^1 | 1.5.0 | up to date |
| bytes | ^1 | 1.10.1 | up to date |
| chrono ⚠️ | ^0.4 | 0.4.40 | maybe insecure |
| clap | ^4 | 4.5.37 | up to date |
| clap_builder | ^4 | 4.5.37 | up to date |
| concurrent-queue | ^2 | 2.5.0 | up to date |
| crc32fast | ^1 | 1.4.2 | up to date |
| crossbeam-utils | ^0.8 | 0.8.21 | up to date |
| deranged | ^0.4 | 0.4.0 | up to date |
| digest | ^0.10 | 0.10.7 | up to date |
| either | ^1 | 1.15.0 | up to date |
| euclid | ^0.22 | 0.22.11 | up to date |
| event-listener | ^5 | 5.4.0 | up to date |
| form_urlencoded | ^1 | 1.2.1 | up to date |
| futures | ^0.3 | 0.3.31 | up to date |
| futures-channel | ^0.3 | 0.3.31 | up to date |
| futures-core | ^0.3 | 0.3.31 | up to date |
| futures-executor | ^0.3 | 0.3.31 | up to date |
| futures-io | ^0.3 | 0.3.31 | up to date |
| futures-sink | ^0.3 | 0.3.31 | up to date |
| futures-task ⚠️ | ^0.3 | 0.3.31 | maybe insecure |
| futures-util | ^0.3 | 0.3.31 | up to date |
| getrandom | ^0.2 | 0.3.2 | out of date |
| hashbrown | ^0.14 | 0.15.2 | out of date |
| hmac | ^0.12 | 0.12.1 | up to date |
| hyper ⚠️ | ^0.14 | 1.6.0 | out of date |
| indexmap | ^2 | 2.9.0 | up to date |
| lazy_static | ^1 | 1.5.0 | up to date |
| libc | ^0.2 | 0.2.172 | up to date |
| libsqlite3-sys | ^0.30 | 0.33.0 | out of date |
| log | ^0.4 | 0.4.27 | up to date |
| lyon | ^1 | 1.0.1 | up to date |
| lyon_path | ^1 | 1.0.7 | up to date |
| md-5 | ^0.10 | 0.10.6 | up to date |
| memchr | ^2 | 2.7.4 | up to date |
| miniz_oxide | ^0.8 | 0.8.8 | up to date |
| nom | ^7 | 8.0.0 | out of date |
| num-bigint | ^0.4 | 0.4.6 | up to date |
| num-integer | ^0.1 | 0.1.46 | up to date |
| num-traits | ^0.2 | 0.2.19 | up to date |
| once_cell | ^1 | 1.21.3 | up to date |
| percent-encoding | ^2 | 2.3.1 | up to date |
| phf | ^0.11 | 0.11.3 | up to date |
| phf_shared | ^0.11 | 0.11.3 | up to date |
| prost | ^0.9 | 0.13.5 | out of date |
| prost-types | ^0.9 | 0.13.5 | out of date |
| rand | ^0.8 | 0.9.1 | out of date |
| rand_core | ^0.6 | 0.9.3 | out of date |
| regex ⚠️ | ^1 | 1.11.1 | maybe insecure |
| regex-automata | ^0.4 | 0.4.9 | up to date |
| regex-syntax | ^0.8 | 0.8.5 | up to date |
| rust_decimal | ^1 | 1.37.1 | up to date |
| rustix | ^0.38 | 1.0.5 | out of date |
| rustls ⚠️ | ^0.23 | 0.23.26 | maybe insecure |
| rustls-webpki | ^0.103 | 0.103.1 | up to date |
| sea-orm | ^1 | 1.1.10 | up to date |
| sea-query-binder | ^0.7 | 0.7.0 | up to date |
| semver | ^1 | 1.0.26 | up to date |
| serde | ^1 | 1.0.219 | up to date |
| serde_json | ^1 | 1.0.140 | up to date |
| simd-adler32 | ^0.3 | 0.3.7 | up to date |
| smallvec ⚠️ | ^1 | 1.15.0 | maybe insecure |
| spin | ^0.9 | 0.10.0 | out of date |
| sqlx ⚠️ | ^0.8 | 0.8.5 | maybe insecure |
| sqlx-postgres | ^0.8 | 0.8.5 | up to date |
| sqlx-sqlite | ^0.8 | 0.8.5 | up to date |
| strum | ^0.26 | 0.27.1 | out of date |
| subtle | ^2 | 2.6.1 | up to date |
| thiserror | ^2 | 2.0.12 | up to date |
| time | ^0.3 | 0.3.41 | up to date |
| tokio ⚠️ | ^1 | 1.44.2 | maybe insecure |
| tokio-rustls | ^0.26 | 0.26.2 | up to date |
| tokio-util | ^0.7 | 0.7.15 | up to date |
| tracing | ^0.1 | 0.1.41 | up to date |
| tracing-core | ^0.1 | 0.1.33 | up to date |
| tungstenite | ^0.26 | 0.26.2 | up to date |
| unicode-properties | ^0.1 | 0.1.3 | up to date |
| url | ^2 | 2.5.4 | up to date |
| uuid | ^1 | 1.16.0 | up to date |
| wasm-encoder | ^0.221 | 0.229.0 | out of date |
| wasmparser | ^0.221 | 0.229.0 | out of date |
| wasmtime | ^29 | 32.0.0 | out of date |
| wasmtime-cranelift | ^29 | 32.0.0 | out of date |
| wasmtime-environ | ^29 | 32.0.0 | out of date |
(117 total, 19 outdated, 8 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| aho-corasick | ^1 | 1.1.3 | up to date |
| anstream | ^0.6 | 0.6.18 | up to date |
| arrayvec | ^0.7 | 0.7.6 | up to date |
| async-compression | ^0.4 | 0.4.23 | up to date |
| async-std | ^1 | 1.13.1 | up to date |
| async-tungstenite | ^0.29 | 0.29.1 | up to date |
| aws-config | ^1 | 1.6.2 | up to date |
| aws-credential-types | ^1 | 1.2.3 | up to date |
| aws-runtime | ^1 | 1.5.7 | up to date |
| aws-sigv4 | ^1 | 1.3.1 | up to date |
| aws-smithy-async | ^1 | 1.2.5 | up to date |
| aws-smithy-http | ^0.62 | 0.62.1 | up to date |
| aws-smithy-runtime | ^1 | 1.8.3 | up to date |
| aws-smithy-runtime-api | ^1 | 1.8.0 | up to date |
| aws-smithy-types | ^1 | 1.3.1 | up to date |
| base64 | ^0.22 | 0.22.1 | up to date |
| base64ct | ^1 | 1.7.3 | up to date |
| bigdecimal | ^0.4 | 0.4.8 | up to date |
| bit-set | ^0.8 | 0.8.0 | up to date |
| bitflags | ^2 | 2.9.0 | up to date |
| bstr | ^1 | 1.12.0 | up to date |
| bytemuck | ^1 | 1.22.0 | up to date |
| byteorder | ^1 | 1.5.0 | up to date |
| bytes | ^1 | 1.10.1 | up to date |
| cc | ^1 | 1.2.20 | up to date |
| chrono ⚠️ | ^0.4 | 0.4.40 | maybe insecure |
| clap | ^4 | 4.5.37 | up to date |
| clap_builder | ^4 | 4.5.37 | up to date |
| concurrent-queue | ^2 | 2.5.0 | up to date |
| crc32fast | ^1 | 1.4.2 | up to date |
| crossbeam-utils | ^0.8 | 0.8.21 | up to date |
| deranged | ^0.4 | 0.4.0 | up to date |
| digest | ^0.10 | 0.10.7 | up to date |
| either | ^1 | 1.15.0 | up to date |
| euclid | ^0.22 | 0.22.11 | up to date |
| event-listener | ^5 | 5.4.0 | up to date |
| form_urlencoded | ^1 | 1.2.1 | up to date |
| futures | ^0.3 | 0.3.31 | up to date |
| futures-channel | ^0.3 | 0.3.31 | up to date |
| futures-core | ^0.3 | 0.3.31 | up to date |
| futures-executor | ^0.3 | 0.3.31 | up to date |
| futures-io | ^0.3 | 0.3.31 | up to date |
| futures-sink | ^0.3 | 0.3.31 | up to date |
| futures-task ⚠️ | ^0.3 | 0.3.31 | maybe insecure |
| futures-util | ^0.3 | 0.3.31 | up to date |
| getrandom | ^0.2 | 0.3.2 | out of date |
| hashbrown | ^0.14 | 0.15.2 | out of date |
| heck | ^0.4 | 0.5.0 | out of date |
| hmac | ^0.12 | 0.12.1 | up to date |
| hyper ⚠️ | ^0.14 | 1.6.0 | out of date |
| indexmap | ^2 | 2.9.0 | up to date |
| itertools | ^0.13 | 0.14.0 | out of date |
| lazy_static | ^1 | 1.5.0 | up to date |
| libc | ^0.2 | 0.2.172 | up to date |
| libsqlite3-sys | ^0.30 | 0.33.0 | out of date |
| log | ^0.4 | 0.4.27 | up to date |
| lyon | ^1 | 1.0.1 | up to date |
| lyon_path | ^1 | 1.0.7 | up to date |
| md-5 | ^0.10 | 0.10.6 | up to date |
| memchr | ^2 | 2.7.4 | up to date |
| miniz_oxide | ^0.8 | 0.8.8 | up to date |
| nom | ^7 | 8.0.0 | out of date |
| num-bigint | ^0.4 | 0.4.6 | up to date |
| num-integer | ^0.1 | 0.1.46 | up to date |
| num-traits | ^0.2 | 0.2.19 | up to date |
| once_cell | ^1 | 1.21.3 | up to date |
| percent-encoding | ^2 | 2.3.1 | up to date |
| phf | ^0.11 | 0.11.3 | up to date |
| phf_shared | ^0.11 | 0.11.3 | up to date |
| prettyplease | ^0.2 | 0.2.32 | up to date |
| proc-macro2 | ^1 | 1.0.95 | up to date |
| prost | ^0.9 | 0.13.5 | out of date |
| prost-types | ^0.9 | 0.13.5 | out of date |
| quote | ^1 | 1.0.40 | up to date |
| rand | ^0.8 | 0.9.1 | out of date |
| rand_core | ^0.6 | 0.9.3 | out of date |
| regex ⚠️ | ^1 | 1.11.1 | maybe insecure |
| regex-automata | ^0.4 | 0.4.9 | up to date |
| regex-syntax | ^0.8 | 0.8.5 | up to date |
| rust_decimal | ^1 | 1.37.1 | up to date |
| rustix | ^0.38 | 1.0.5 | out of date |
| rustls ⚠️ | ^0.23 | 0.23.26 | maybe insecure |
| rustls-webpki | ^0.103 | 0.103.1 | up to date |
| sea-orm | ^1 | 1.1.10 | up to date |
| sea-query-binder | ^0.7 | 0.7.0 | up to date |
| semver | ^1 | 1.0.26 | up to date |
| serde | ^1 | 1.0.219 | up to date |
| serde_derive | ^1 | 1.0.219 | up to date |
| serde_json | ^1 | 1.0.140 | up to date |
| simd-adler32 | ^0.3 | 0.3.7 | up to date |
| smallvec ⚠️ | ^1 | 1.15.0 | maybe insecure |
| spin | ^0.9 | 0.10.0 | out of date |
| sqlx ⚠️ | ^0.8 | 0.8.5 | maybe insecure |
| sqlx-macros | ^0.8 | 0.8.5 | up to date |
| sqlx-macros-core | ^0.8 | 0.8.5 | up to date |
| sqlx-postgres | ^0.8 | 0.8.5 | up to date |
| sqlx-sqlite | ^0.8 | 0.8.5 | up to date |
| strum | ^0.26 | 0.27.1 | out of date |
| subtle | ^2 | 2.6.1 | up to date |
| syn | ^2 | 2.0.100 | up to date |
| thiserror | ^2 | 2.0.12 | up to date |
| time | ^0.3 | 0.3.41 | up to date |
| time-macros | ^0.2 | 0.2.22 | up to date |
| tokio ⚠️ | ^1 | 1.44.2 | maybe insecure |
| tokio-rustls | ^0.26 | 0.26.2 | up to date |
| tokio-util | ^0.7 | 0.7.15 | up to date |
| tracing | ^0.1 | 0.1.41 | up to date |
| tracing-core | ^0.1 | 0.1.33 | up to date |
| tungstenite | ^0.26 | 0.26.2 | up to date |
| unicode-properties | ^0.1 | 0.1.3 | up to date |
| url | ^2 | 2.5.4 | up to date |
| uuid | ^1 | 1.16.0 | up to date |
| wasm-encoder | ^0.221 | 0.229.0 | out of date |
| wasmparser | ^0.221 | 0.229.0 | out of date |
| wasmtime | ^29 | 32.0.0 | out of date |
| wasmtime-cranelift | ^29 | 32.0.0 | out of date |
| wasmtime-environ | ^29 | 32.0.0 | out of date |
xtaskNo external dependencies! 🙌
futures-task: futures_task::waker may cause a use-after-free if used on a type that isn't 'staticAffected versions of the crate did not properly implement a 'static lifetime bound on the waker function.
This resulted in a use-after-free if Waker::wake() is called after original data had been dropped.
The flaw was corrected by adding 'static lifetime bound to the data waker takes.
chrono: Potential segfault in `localtime_r` invocationsUnix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
No workarounds are known.
smallvec: Buffer overflow in SmallVec::insert_manyA bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.
This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.
The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.
Thank you to Yechan Bae (@Qwaz) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.
hyper: Lenient `hyper` header parsing of `Content-Length` could allow request smugglinghyper's HTTP header parser accepted, according to RFC 7230, illegal contents inside Content-Length headers.
Due to this, upstream HTTP proxies that ignore the header may still forward them along if it chooses to ignore the error.
To be vulnerable, hyper must be used as an HTTP/1 server and using an HTTP proxy upstream that ignores the header's contents
but still forwards it. Due to all the factors that must line up, an attack exploiting this vulnerability is unlikely.
hyper: Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data lossWhen decoding chunk sizes that are too large, hyper's code would encounter an integer overflow. Depending on the situation,
this could lead to data loss from an incorrect total size, or in rarer cases, a request smuggling attack.
To be vulnerable, you must be using hyper for any HTTP/1 purpose, including as a client or server, and consumers must send
requests or responses that specify a chunk size greater than 18 exabytes. For a possible request smuggling attack to be possible,
any upstream proxies must accept a chunk size greater than 64 bits.
regex: Regexes with large repetitions on empty sub-expressions take a very long time to parseThe Rust Security Response WG was notified that the regex crate did not
properly limit the complexity of the regular expressions (regex) it parses. An
attacker could use this security issue to perform a denial of service, by
sending a specially crafted regex to a service accepting untrusted regexes. No
known vulnerability is present when parsing untrusted input with trusted
regexes.
This issue has been assigned CVE-2022-24713. The severity of this vulnerability
is "high" when the regex crate is used to parse untrusted regexes. Other uses
of the regex crate are not affected by this vulnerability.
The regex crate features built-in mitigations to prevent denial of service
attacks caused by untrusted regexes, or untrusted input matched by trusted
regexes. Those (tunable) mitigations already provide sane defaults to prevent
attacks. This guarantee is documented and it's considered part of the crate's
API.
Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.
All versions of the regex crate before or equal to 1.5.4 are affected by this
issue. The fix is include starting from regex 1.5.5.
We recommend everyone accepting user-controlled regexes to upgrade immediately
to the latest version of the regex crate.
Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, we do not recommend denying known problematic regexes.
We want to thank Addison Crump for responsibly disclosing this to us according to the Rust security policy, and for helping review the fix.
We also want to thank Andrew Gallant for developing the fix, and Pietro Albini for coordinating the disclosure and writing this advisory.
tokio: reject_remote_clients Configuration corruptionOn Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.
This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.
The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.
Ensure that pipe_mode is set first after initializing a ServerOptions. For example:
let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);
sqlx: Binary Protocol Misinterpretation caused by Truncating or Overflowing CastsThe following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:
SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
(Archive link for posterity.)
Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow, causing the server to interpret the rest of the string as binary protocol commands or other data.
It appears SQLx does perform truncating casts in a way that could be problematic, for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163
This code has existed essentially since the beginning,
so it is reasonable to assume that all published versions <= 0.8.0 are affected.
As always, you should make sure your application is validating untrustworthy user input. Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB. Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.
Encode::size_hint()
can be used for sanity checks, but do not assume that the size returned is accurate.
For example, the Json<T> and Text<T> adapters have no reasonable way to predict or estimate the final encoded size,
so they just return size_of::<T>() instead.
For web application backends, consider adding some middleware that limits the size of request bodies by default.
sqlx 0.8.1 has been released with the fix: https://github.com/launchbadge/sqlx/blob/main/CHANGELOG.md#081---2024-08-23
Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated: https://github.com/launchbadge/sqlx/issues/3440#issuecomment-2307956901
MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.
rustls: rustls network-reachable panic in `Acceptor::accept`A bug introduced in rustls 0.23.13 leads to a panic if the received
TLS ClientHello is fragmented. Only servers that use
rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.