[pull] main from nushell:main #1241
Security advisories found
1 unmaintained, 1 unsound
Details
Warnings
RUSTSEC-2024-0370
proc-macro-error is unmaintained
| Details | |
|---|---|
| Status | unmaintained |
| Package | proc-macro-error |
| Version | 1.0.4 |
| URL | https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20 |
| Date | 2024-09-01 |
proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.
proc-macro-error also depends on syn 1.x, which may be bringing duplicate dependencies into dependant build trees.
Possible Alternative(s)
RUSTSEC-2024-0379
Multiple soundness issues
| Details | |
|---|---|
| Status | unsound |
| Package | fast-float |
| Version | 0.2.0 |
| URL | aldanor/fast-float-rust#35 |
| Date | 2024-10-31 |
fast-float contains multiple soundness issues:
- Undefined behavior when checking input length, which has been merged but no package pubished.
- Many functions marked as safe with non-local safety guarantees
The library is also unmaintained.
Alternatives
For quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of lexical has been merged into libcore. When requiring direct parsing from bytes and/or partial parsers, the fast-float2 fork of fast-float containing these security patches and reduces overall usage of unsafe.