chore(deps): update rust crate borsh to v1.5.1 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
borsh (source)	dependencies	patch	1.5.0 -> 1.5.1

GitHub Vulnerability Alerts

GHSA-fjx5-qpf4-xjf2

Affected versions of borsh cause undefined behavior when zero-sized-types (ZST) are parsed and the Copy/Clone traits are not implemented/derived. For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy (this can be achieved through a singleton), then accessing/writing to deserialized data will cause a segmentation fault.

There is currently no way for borsh to read data without also providing a Rust type. Therefore, if you are not using ZST for serialization, then you are not affected by this issue.

---

Release Notes

near/borsh-rs (borsh)

v1.5.1

Compare Source

Added

• (schema) for HashMap<K, V> -> HashMap<K, V, S>, for HashSet<T> -> HashSet<T, S> (#​294)

Fixed

• fixed linting warnings for Rust 1.78 stable, 1.80 nightly (#​295)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[monoid]

This is NOT a security update (it would be from pre-1.5.x).