Skip to content

Bump the cargo group across 1 directory with 11 updates #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump the cargo group across 1 directory with 11 updates #2

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 12, 2025

Bumps the cargo group with 10 updates in the / directory:

Package From To
bumpalo 3.10.0 3.19.0
h2 0.3.13 0.3.27
mio 0.8.4 0.8.11
secp256k1 0.24.0 0.24.3
shlex 1.1.0 1.3.0
snow 0.9.0 0.9.3
time 0.1.44 0.1.45
tokio 1.19.2 1.26.0
wasmtime 0.38.1 0.38.3
webpki 0.22.0 0.22.2

Updates bumpalo from 3.10.0 to 3.19.0

Changelog

Sourced from bumpalo's changelog.

3.19.0

Released 2025-06-24.

Added

  • Added bumpalo::collections::Vec::retain_mut, similar to std::vec::Vec::retain_mut.

3.18.1

Released 2025-06-05.

Removed

  • Removed the allocator-api2 version bump from 3.18.0, as it was not actually semver compatible.

3.18.0 (yanked)

Released 2025-06-05.

Added

  • Added support for enforcing a minimum alignment on all allocations inside a Bump arena, which can provide speed ups when allocating objects whose alignment is less than or equal to that minimum.
  • Added serde serialization support for bumpalo::collections::String.
  • Added some missing fallible slice allocation function variants.

Changed

  • Replaced extend_from_slice implementation with a formally-verified version that is also faster and more-optimizable for LLVM.
  • Updated allocator-api2 support to version 0.3.*.

Fixed

  • Fixed a bug where the allocated_bytes metrics helper was accidentally including the size of bumpalo's footer, rather than just reporting the user-allocated bytes.

3.17.0

... (truncated)

Commits

Updates h2 from 0.3.13 to 0.3.27

Release notes

Sourced from h2's releases.

v0.3.26

What's Changed

  • Limit number of CONTINUATION frames for misbehaving connections.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.

v0.3.25

What's Changed

Full Changelog: hyperium/h2@v0.3.24...v0.3.25

v0.3.24

Fixed

  • Limit error resets for misbehaving connections.

v0.3.23

What's Changed

v0.3.22

What's Changed

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

New Contributors

v0.3.21

What's Changed

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

New Contributors

v0.3.20

Bug Fixes

... (truncated)

Changelog

Sourced from h2's changelog.

0.3.27 (July 11, 2025)

  • Fix notifying wakers when detecting local stream errors.

0.3.26 (April 3, 2024)

  • Limit number of CONTINUATION frames for misbehaving connections.

0.3.25 (March 15, 2024)

  • Improve performance decoding many headers.

0.3.24 (January 17, 2024)

  • Limit error resets for misbehaving connections.

0.3.23 (January 10, 2024)

  • Backport fix from 0.4.1 for stream capacity assignment.

0.3.22 (November 15, 2023)

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

0.3.21 (August 21, 2023)

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

0.3.20 (June 26, 2023)

  • Fix panic if a server received a request with a :status pseudo header in the 1xx range.
  • Fix panic if a reset stream had pending push promises that were more than allowed.
  • Fix potential flow control overflow by subtraction, instead returning a connection error.

0.3.19 (May 12, 2023)

  • Fix counting reset streams when triggered by a GOAWAY.
  • Send too_many_resets in opaque debug data of GOAWAY when too many resets received.

0.3.18 (April 17, 2023)

  • Fix panic because of opposite check in is_remote_local().

0.3.17 (April 13, 2023)

  • Add Error::is_library() method to check if the originated inside h2.

... (truncated)

Commits
  • f6237ac v0.3.27
  • f61332e refactor: change local reset counter to use type system more
  • 3f1a8e3 style: fix anonymous lifetime syntax
  • 778aa7e fix: notify_recv after send_reset() in reset_on_recv_stream_err() to ensure l...
  • be10b77 ci: pin more deps for MSRV job (#817)
  • c0d9feb ci: pin deps for MSRV
  • 5ccd9cf lints: fix unexpected cfgs warnings
  • e6e3e9c fix: return a WriteZero error if frames cannot be written (#783)
  • 357127e v0.3.26
  • 1a357aa fix: limit number of CONTINUATION frames allowed
  • Additional commits viewable in compare view

Updates mio from 0.8.4 to 0.8.11

Changelog

Sourced from mio's changelog.

0.8.11

0.8.10

Added

0.8.9

Added

Fixed

0.8.8

Fixed

0.8.7

Added

  • Add/fix support for tvOS and watchOS, Mio should now build for tvOS and

... (truncated)

Commits

Updates secp256k1 from 0.24.0 to 0.24.3

Changelog

Sourced from secp256k1's changelog.

0.32.0 - 2025-10-02

Remove Secp256k1 from public API functions

This one is massive, we came up with an solution to the global context that works in both std and no-std environments. With this release you don't have to create and pass in a context object in all the APIs - BOOM!

  • Introduce new global context API with rerandomization #806
  • Remove context from the API #844
  • Fix rerandomization seed usage #855

(Note, to help with the upgrade path we left the methods on the context in place but deprecated.)

And we also did:

  • Remove the bitcoin-hashes feature (and dependency) #837
  • Introduce Arbitrary crate and add PublicKey arbitrary impl #826
  • Add arbitrary impl for types used in PSBTs #828
  • secp256k1-sys: Fix lowmemory feature #799
  • Improve RecoveryId conversion functions #800
  • Explicitly set RecoveryId value #801
  • Rename secret_bytes to to_secret_bytes (in Keypair and ecdh::SharedSecret) #863

Add support for MuSig2

Done as an initial PR #716 then a bunch of follow up PRs:

0.31.1 - 2025-06-23

  • Update deprecation notes with since instead of TBD.

0.31.0 - 2025-04-21

  • Update rand to 0.9 #788
  • Create keys from owned array values instead of from references #781
  • Add from_u8_masked RecoveryId constructor #778
  • Update upstream to 0cdc758a56360bf58a851fe91085a327ec97685a (secp256k1-sys 0.6) #764
  • Add Keypair::sign_schnorr_no_aux_rand #762
  • Replace Message with Into<Message> in ECDSA signing API #755
  • Deprecate ElligatorSwiftParty in favor of Party #752

... (truncated)

Commits

Updates shlex from 1.1.0 to 1.3.0

Changelog

Sourced from shlex's changelog.

1.3.0

  • Full fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27:
    • Deprecates quote APIs in favor of try_ equivalents that complain about nul bytes.
    • Also adds a builder API, which allows re-enabling nul bytes without using the deprecated interface, and in the future can allow other things (as discussed in quoting_warning).
    • Adds documentation about various security risks that remain, particularly with interactive shells.
  • Adds explicit MSRV of 1.46.0.

1.2.1

  • Partial fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27 without bumping MSRV:
    • The bytes { and \xa0 are now escaped by quoting functions.

1.2.0

  • Adds bytes module to support operating directly on byte strings.
Commits
  • 4a0724b Address security issues involving quote API
  • 4c53044 Minimal fix for the high-severity issue without bumping MSRV
  • fde8a71 Version bump
  • f44b62e Merge pull request #15 from danielparks/bytes
  • 0c786d4 Implement Shlex with bytes::Shlex.
  • 879d212 Add support for operating on byte strings
  • aa2d6e3 Merge pull request #14 from atouchet/badge
  • 18d1dae Fix CI badge
  • 6064b48 Merge pull request #11 from adetaylor/fuzz
  • 6480b2c Adding fuzzers for unsafe code.
  • Additional commits viewable in compare view

Updates snow from 0.9.0 to 0.9.3

Release notes

Sourced from snow's releases.

v0.9.3

This is a quick patch release to use the stable 4.0 version of curve25519-dalek.

v0.9.2

This is a patch release to address a correctness issue for compliance with the Noise specification: the nonce $2^{64} - 1$ is reserved for rekeying, and CipherState and StatelessCipherState did not check that, instead just making sure that there was no integer overflow.

Thanks to @​kjvalencik for reporting the issue and @​complexspaces for contributing the fix PR (#152).

Thanks to @​robyoder as well for fixing broken links and making sure all links were HTTPS (#151).

Full Changelog: mcginty/snow@v0.9.1...v0.9.2

v0.9.1

This is a patch release to fix build breakages due to not pinning curve25519-dalek to a specific pre-release version.

Thanks to @​Kofituo and @​thomaseizinger for bringing it to attention and @​tarcieri for the fix PR (#148).

Commits
  • 59804f8 meta: v0.9.3 release
  • 396805b dependency: upgrade to curve25519-dalek 4.0 (#161)
  • a11d0d9 meta: v0.9.2 release
  • 6c8e756 Fix nonce incrementing in stateful transport to match the specification
  • 3b33f0a Update curve25519-dalek requirement from =4.0.0-rc.0 to =4.0.0-rc.1
  • 386434a Use https everywhere
  • 5227051 Fix bad links
  • fd56e6c meta: v0.9.1 release
  • bc5d783 Bump curve25519-dalek to v4.0.0-rc.0
  • See full diff in compare view

Updates time from 0.1.44 to 0.1.45

Commits

Updates tokio from 1.19.2 to 1.26.0

Release notes

Sourced from tokio's releases.

Tokio v1.26.0

Fixed

Added

Changed

Internal Changes

Unstable

Documented

... (truncated)

Commits

Updates wasmtime from 0.38.1 to 0.38.3

Release notes

Sourced from wasmtime's releases.

v38.0.2: Release Wasmtime 38.0.2 (#11903)

38.0.2

Released 2025-10-21.

Changed

  • This repository is attempting to start out using GitHub's "Immutable Releases" feature with this release, and this'll be the first release, assuming all goes well, that has this enabled. #11901

Fixed

  • Fix compatibility with the Go runtime on Windows for exceptions. #11892

v10.0.2: Release Wasmtime 10.0.2 (#6991)

No release notes provided.

dev

No release notes provided.

Commits

Updates wasmtime-jit-debug from 0.38.1 to 0.38.3

Release notes

Sourced from wasmtime-jit-debug's releases.

v38.0.2: Release Wasmtime 38.0.2 (#11903)

38.0.2

Released 2025-10-21.

Changed

  • This repository is attempting to start out using GitHub's "Immutable Releases" feature with this release, and this'll be the first release, assuming all goes well, that has this enabled. #11901

Fixed

  • Fix compatibility with the Go runtime on Windows for exceptions. #11892

v10.0.2: Release Wasmtime 10.0.2 (#6991)

No release notes provided.

dev

No release notes provided.

Commits

Updates webpki from 0.22.0 to 0.22.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the cargo group across 1 directory with 11 updates
7658108 
Bumps the cargo group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bumpalo](https://github.com/fitzgen/bumpalo) | `3.10.0` | `3.19.0` |
| [h2](https://github.com/hyperium/h2) | `0.3.13` | `0.3.27` |
| [mio](https://github.com/tokio-rs/mio) | `0.8.4` | `0.8.11` |
| [secp256k1](https://github.com/rust-bitcoin/rust-secp256k1) | `0.24.0` | `0.24.3` |
| [shlex](https://github.com/comex/rust-shlex) | `1.1.0` | `1.3.0` |
| [snow](https://github.com/mcginty/snow) | `0.9.0` | `0.9.3` |
| [time](https://github.com/time-rs/time) | `0.1.44` | `0.1.45` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.19.2` | `1.26.0` |
| [wasmtime](https://github.com/bytecodealliance/wasmtime) | `0.38.1` | `0.38.3` |
| [webpki](https://github.com/briansmith/webpki) | `0.22.0` | `0.22.2` |



Updates `bumpalo` from 3.10.0 to 3.19.0
- [Changelog](https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fitzgen/bumpalo/commits)

Updates `h2` from 0.3.13 to 0.3.27
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/v0.3.27/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.13...v0.3.27)

Updates `mio` from 0.8.4 to 0.8.11
- [Release notes](https://github.com/tokio-rs/mio/releases)
- [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/mio@v0.8.4...v0.8.11)

Updates `secp256k1` from 0.24.0 to 0.24.3
- [Changelog](https://github.com/rust-bitcoin/rust-secp256k1/blob/master/CHANGELOG.md)
- [Commits](rust-bitcoin/rust-secp256k1@secp256k1-0.24.0...secp256k1-0.24.3)

Updates `shlex` from 1.1.0 to 1.3.0
- [Changelog](https://github.com/comex/rust-shlex/blob/master/CHANGELOG.md)
- [Commits](comex/rust-shlex@1.1.0...1.3.0)

Updates `snow` from 0.9.0 to 0.9.3
- [Release notes](https://github.com/mcginty/snow/releases)
- [Commits](mcginty/snow@v0.9.0...v0.9.3)

Updates `time` from 0.1.44 to 0.1.45
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](https://github.com/time-rs/time/commits)

Updates `tokio` from 1.19.2 to 1.26.0
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.19.2...tokio-1.26.0)

Updates `wasmtime` from 0.38.1 to 0.38.3
- [Release notes](https://github.com/bytecodealliance/wasmtime/releases)
- [Changelog](https://github.com/bytecodealliance/wasmtime/blob/main/docs/contributing-release-process.md)
- [Commits](bytecodealliance/wasmtime@v0.38.1...v0.38.3)

Updates `wasmtime-jit-debug` from 0.38.1 to 0.38.3
- [Release notes](https://github.com/bytecodealliance/wasmtime/releases)
- [Changelog](https://github.com/bytecodealliance/wasmtime/blob/main/docs/contributing-release-process.md)
- [Commits](bytecodealliance/wasmtime@v0.38.1...v0.38.3)

Updates `webpki` from 0.22.0 to 0.22.2
- [Commits](https://github.com/briansmith/webpki/commits)

---
updated-dependencies:
- dependency-name: bumpalo
  dependency-version: 3.19.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: h2
  dependency-version: 0.3.27
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: mio
  dependency-version: 0.8.11
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: secp256k1
  dependency-version: 0.24.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: shlex
  dependency-version: 1.3.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: snow
  dependency-version: 0.9.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.1.45
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.26.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: wasmtime
  dependency-version: 0.38.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: wasmtime-jit-debug
  dependency-version: 0.38.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: webpki
  dependency-version: 0.22.2
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Nov 12, 2025
@socket-security
Copy link

socket-security bot commented Nov 12, 2025

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Native binaries present: cargo curve25519-dalek

Location: Package overview

From: ? → cargo/[email protected]

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo tokio

Location: Package overview

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo windows_aarch64_gnullvm

Location: Package overview

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo windows_aarch64_gnullvm

Location: Package overview

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo windows_x86_64_gnullvm

Location: Package overview

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo windows_x86_64_gnullvm

Location: Package overview

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo curve25519-dalek

Install script: Package overview

Source: undefined

From: ? → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo tokio

Install script: Package overview

Source: undefined

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo windows_aarch64_gnullvm

Install script: Package overview

Source: undefined

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo windows_aarch64_gnullvm

Install script: Package overview

Source: undefined

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo windows_x86_64_gnullvm

Install script: Package overview

Source: undefined

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo windows_x86_64_gnullvm

Install script: Package overview

Source: undefined

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Potential code anomaly (AI signal): cargo tokio is 100.0% likely to have a medium risk anomaly

Notes: This code is not malicious but contains unsafe/misleading patterns that are likely to introduce undefined behavior and concurrency bugs. The unsync_load implementation is incorrect: it reads the inner AtomicU32 by casting its pointer to *const u32 and performing a raw read, which is representation-dependent and can produce torn reads or UB when used concurrently. The manual unsafe impl Send/Sync combined with UnsafeCell is risky if the wrapper's invariants are not strictly maintained. Recommendation: remove unsync_load or implement it using safe atomic load operations with explicit ordering, avoid assuming layout equivalence between AtomicU32 and u32, and avoid reintroducing Send/Sync unsafely unless justified with careful invariants and comments.

Confidence: 1.00

Severity: 0.60

From: ? → cargo/[email protected] → cargo/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant