Skip to content

chore(deps): bump the cargo group across 2 directories with 26 updates#16

Open
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/cargo/rust/cargo-4c0f566781
Open

chore(deps): bump the cargo group across 2 directories with 26 updates#16
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/cargo/rust/cargo-4c0f566781

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 20, 2026

Bumps the cargo group with 11 updates in the /rust directory:

Package From To
bumpalo 3.7.0 3.20.2
h2 0.3.4 0.3.27
keccak 0.1.0 0.1.6
mio 0.7.13 0.7.14
num-bigint 0.4.1 0.4.3
openssl 0.10.36 0.10.76
regex 1.5.4 1.5.5
tar 0.4.37 0.4.45
time 0.1.44 0.1.45
tokio 1.10.1 1.16.1
zeroize_derive 1.1.0 1.4.3

Bumps the cargo group with 6 updates in the /rust/auction/program directory:

Package From To
borsh 0.8.2 0.9.3
bumpalo 3.6.1 3.20.2
idna 0.2.2 0.2.3
time 0.1.44 0.1.45
zeroize_derive 1.0.1 1.4.3
thread_local 1.1.3 1.1.9

Updates bumpalo from 3.7.0 to 3.20.2

Changelog

Sourced from bumpalo's changelog.

3.20.2

Released 2026-02-19.

Fixed

  • Restored Send and Sync implementations for Box<T> for T: ?Sized types as well.

3.20.1

Released 2026-02-18.

Fixed

  • Restored Send and Sync implementations for Box<T> when T: Send and T: Sync respectively.

3.20.0

Released 2026-02-18.

Added

  • Added the bumpalo::collections::Vec::pop_if method.

Fixed

  • Fixed a bug in the bumpalo::collections::String::retain method in the face of panics.
  • Made bumpalo::collections::Box<T> covariant with T (just like std::boxed::Box<T>).

3.19.1

Released 2025-12-16.

Changed

  • Annotated bumpalo::collections::String::from_str_in as #[inline].

Fixed

  • Fixed compilation failures with the latest nightly Rust when enabling the

... (truncated)

Commits

Updates h2 from 0.3.4 to 0.3.27

Release notes

Sourced from h2's releases.

v0.3.26

What's Changed

  • Limit number of CONTINUATION frames for misbehaving connections.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.

v0.3.25

What's Changed

Full Changelog: hyperium/h2@v0.3.24...v0.3.25

v0.3.24

Fixed

  • Limit error resets for misbehaving connections.

v0.3.23

What's Changed

v0.3.22

What's Changed

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

New Contributors

v0.3.21

What's Changed

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

New Contributors

v0.3.20

Bug Fixes

... (truncated)

Changelog

Sourced from h2's changelog.

0.3.27 (July 11, 2025)

  • Fix notifying wakers when detecting local stream errors.

0.3.26 (April 3, 2024)

  • Limit number of CONTINUATION frames for misbehaving connections.

0.3.25 (March 15, 2024)

  • Improve performance decoding many headers.

0.3.24 (January 17, 2024)

  • Limit error resets for misbehaving connections.

0.3.23 (January 10, 2024)

  • Backport fix from 0.4.1 for stream capacity assignment.

0.3.22 (November 15, 2023)

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

0.3.21 (August 21, 2023)

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

0.3.20 (June 26, 2023)

  • Fix panic if a server received a request with a :status pseudo header in the 1xx range.
  • Fix panic if a reset stream had pending push promises that were more than allowed.
  • Fix potential flow control overflow by subtraction, instead returning a connection error.

0.3.19 (May 12, 2023)

  • Fix counting reset streams when triggered by a GOAWAY.
  • Send too_many_resets in opaque debug data of GOAWAY when too many resets received.

0.3.18 (April 17, 2023)

  • Fix panic because of opposite check in is_remote_local().

0.3.17 (April 13, 2023)

  • Add Error::is_library() method to check if the originated inside h2.

... (truncated)

Commits
  • f6237ac v0.3.27
  • f61332e refactor: change local reset counter to use type system more
  • 3f1a8e3 style: fix anonymous lifetime syntax
  • 778aa7e fix: notify_recv after send_reset() in reset_on_recv_stream_err() to ensure l...
  • be10b77 ci: pin more deps for MSRV job (#817)
  • c0d9feb ci: pin deps for MSRV
  • 5ccd9cf lints: fix unexpected cfgs warnings
  • e6e3e9c fix: return a WriteZero error if frames cannot be written (#783)
  • 357127e v0.3.26
  • 1a357aa fix: limit number of CONTINUATION frames allowed
  • Additional commits viewable in compare view

Updates keccak from 0.1.0 to 0.1.6

Commits

Updates mio from 0.7.13 to 0.7.14

Changelog

Sourced from mio's changelog.

0.7.14

Fixes

  • Remove use unsound internal macro (#1519).

Added

  • sys::unix::SocketAddr::as_abstract_namespace() (#1520).
Commits
  • 064af84 Release v0.7.14
  • 9507bdf Update outdated comment
  • 7a17b67 Avoid cast pointers to usize in windows::NamedPipe
  • 53288fb Replace offset constants with methods in Windows NamedPipe
  • 5224c00 Reorder NamedPipe fields
  • b01ecbd Remove unsound offset_of macro
  • 1e1b06f Add sys::unix::SocketAddr::as_abstract_namespace()
  • See full diff in compare view

Updates num-bigint from 0.4.1 to 0.4.3

Changelog

Sourced from num-bigint's changelog.

Release 0.4.3 (2021-11-02)

Contributors: @​arvidn, @​cuviper, @​guidovranken

Release 0.4.2 (2021-09-03)

Contributors: @​catenacyber, @​cuviper

Commits

Updates openssl from 0.10.36 to 0.10.76

Release notes

Sourced from openssl's releases.

openssl-v0.10.76

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.75...openssl-v0.10.76

openssl-v0.10.75

What's Changed

... (truncated)

Commits

Updates regex from 1.5.4 to 1.5.5

Changelog

Sourced from regex's changelog.

1.5.5 (2022-03-08)

This releases fixes a security bug in the regex compiler. This bug permits a vector for a denial-of-service attack in cases where the regex being compiled is untrusted. There are no known problems where the regex is itself trusted, including in cases of untrusted haystacks.

Commits

Updates tar from 0.4.37 to 0.4.45

Commits
  • 096e3d1 Bump to 0.4.45 (#443)
  • 17b1fd8 archive: Prevent symlink-directory collision chmod attack (#442)
  • de1a587 archive: Unconditionally honor PAX size (#441)
  • 6071cbe ci: Consolidate workflows (#439)
  • ad1fde9 build-sys: Promote unused_code to an error
  • c8cb250 tests: Squash a warning
  • 638c495 ci: Add xtask infra + reverse dependency testing (#435)
  • 32a9bbb tests: Add RandomReader to exercise partial-read resilience (#436)
  • 9c5df0b Fix GNU long-name extension stream corruption on validation error (#434)
  • 88b1e3b Fix docs typo in header.rs (#431)
  • Additional commits viewable in compare view

Updates time from 0.1.44 to 0.1.45

Commits

Updates tokio from 1.10.1 to 1.16.1

Release notes

Sourced from tokio's releases.

Tokio v1.16.1

1.16.1 (January 28, 2022)

This release fixes a bug in #4428 with the change #4437.

#4428: tokio-rs/tokio#4428 #4437: tokio-rs/tokio#4437

Tokio v1.16.0

Fixes a soundness bug in io::Take (#4428). The unsoundness is exposed when leaking memory in the given AsyncRead implementation and then overwriting the supplied buffer:

impl AsyncRead for Buggy {
    fn poll_read(
        self: Pin<&mut Self>,
        cx: &mut Context<'_>,
        buf: &mut ReadBuf<'_>
    ) -> Poll<Result<()>> {
      let new_buf = vec![0; 5].leak();
      *buf = ReadBuf::new(new_buf);
      buf.put_slice(b"hello");
      Poll::Ready(Ok(()))
    }
}

Also, this release includes improvements to the multi-threaded scheduler that can increase throughput by up to 20% in some cases (#4383).

Fixed

  • io: soundness don't expose uninitialized memory when using io::Take in edge case (#4428)
  • fs: ensure File::write results in a write syscall when the runtime shuts down (#4316)
  • process: drop pipe after child exits in wait_with_output (#4315)
  • rt: improve error message when spawning a thread fails (#4398)
  • rt: reduce false-positive thread wakups in the multi-threaded scheduler (#4383)
  • sync: don't inherit Send from parking_lot::*Guard (#4359)

Added

  • net: TcpSocket::linger() and set_linger() (#4324)
  • net: impl UnwindSafe for socket types (#4384)
  • rt: impl UnwindSafe for JoinHandle (#4418)
  • sync: watch::Receiver::has_changed() (#4342)
  • sync: oneshot::Receiver::blocking_recv() (#4334)
  • sync: RwLock blocking operations (#4425)

Unstable

... (truncated)

Commits

Updates zeroize_derive from 1.1.0 to 1.4.3

Changelog

Sourced from zeroize_derive's changelog.

1.4.3 (2021-11-04)

Added

  • Implement Zeroize for NonZeroX

Changed

  • Moved to RustCrypto/utils repository

1.4.2 (2021-09-21)

Added

  • Derive Default on Zeroizing

1.4.1 (2021-07-20)

Added

  • Implement Zeroize for [MaybeUninit<Z>]

1.4.0 (2021-07-18)

NOTE: This release includes an MSRV bump to Rust 1.51. Please use zeroize = "1.3.0" if you would like to support older Rust versions.

Added

  • Use const generics to impl Zeroize for [Z; N]; MSRV 1.51
  • Zeroizing::clone_from now zeroizes the destination before cloning

1.3.0 (2021-04-19)

Added

  • impl Zeroize for Box<[Z]>
  • Clear residual space within Option

Changed

  • Ensure Option is None when zeroized
  • Bump MSRV to 1.47

1.2.0 (2020-12-09)

Added

  • Zeroize support for x86(-64) SIMD registers

Changed

  • Simplify String::zeroize
  • MSRV 1.44+

1.1.1 (2020-09-15)

  • Add doc_cfg
  • zeroize entire capacity of String
  • zeroize entire capacity of Vec
Commits

Updates borsh from 0.8.2 to 0.9.3

Changelog

Sourced from borsh's changelog.

[0.9.3] - 2022-02-03

  • Fix no_std compatibility.
  • Reduce code bloat in derived BorshSerialize impl for enums.

[0.9.2] - 2022-01-25

  • Upgrade hashbrown from 0.9 to 0.11. This can breakage in the rare case that you use borsh schema together with no-std support and rely on a specific version hashbrown of SchemaContainer. This is considered to be obscure enough to not warrant a semver bump.

[0.9.1] - 2021-07-14

  • Eliminated unsafe code from both ser and de of u8 (#26)
  • Implemented ser/de for reference count types (#27)
  • Added serialization helpers to improve api ergonomics (#34)
  • Implemented schema for arrays and fix box bounds (#36)
  • Implemented (de)ser for PhantomData (#37)
  • Implemented const-generics under feature (#38)
  • Added an example of direct BorshSerialize::serialize usage with vector and slice buffers (#29)

[0.9.0] - 2021-03-18

  • BREAKING CHANGE: is_u8 optimization helper is now unsafe since it may cause undefined behavior if it returns true for the type that is not safe to Copy (#21)
  • Extended the schema impls to support longer arrays to match the de/serialization impls (#22)
Commits
  • eeb969c ci: publish macros crates even without changes (#80)
  • 5ff9c6f fix no_std compatability (#79)
  • f341871 Tweak enum serialization to generate better LLVM IR and more compact code (#77)
  • 36e63e7 conditionally push and create release only if a tag is created (#74)
  • 5c89866 fix(infra): checkout: set fetch-depth to pull tags (#72)
  • c88de8b escape git_tag_message body (#73)
  • 5c10694 ensure to contain git body in git_tag_message (#70)
  • d1edc1e fix(infra): env variables (#69)
  • 41ca49e add git author name (#68)
  • ef2cf84 feat(infra): introduce automated publishing (#67)
  • Additional commits viewable in compare view

Updates bumpalo from 3.6.1 to 3.20.2

Changelog

Sourced from bumpalo's changelog.

3.20.2

Released 2026-02-19.

Fixed

  • Restored Send and Sync implementations for Box<T> for T: ?Sized types as well.

3.20.1

Released 2026-02-18.

Fixed

  • Restored Send and Sync implementations for Box<T> when T: Send and T: Sync respectively.

3.20.0

Released 2026-02-18.

Added

  • Added the bumpalo::collections::Vec::pop_if method.

Fixed

  • Fixed a bug in the bumpalo::collections::String::retain method in the face of panics.
  • Made bumpalo::collections::Box<T> covariant with T (just like std::boxed::Box<T>).

3.19.1

Released 2025-12-16.

Changed

  • Annotated bumpalo::collections::String::from_str_in as #[inline].

Fixed

  • Fixed compilation failures with the latest nightly Rust when enabling the

... (truncated)

Commits

Updates bzip2 from 0.3.3 to 0.4.4

Release notes

Sourced from bzip2's releases.

Version 0.5.2 (and 0.1.13 for bzip2-sys)

Some minor fixes this time

  • better wasm support (and we test wasm on CI)
  • make bz_internal_error an extern fn by @​folkertdev in trifectatechfoundation/bzip2-rs#135 fixes a soundness issue. This is technically a semver-breaking change, but major versions for -sys crates create a lot of churn. We don't expect users to run into this

What's Changed

New Contributors

Full Changelog: trifectatechfoundation/bzip2-rs@v0.5.1...v0.5.2

Version 0.5.1 (and 0.1.12 for bzip2-sys)

Highlights

Most changes relate to libbz2-rs-sys: we no longer enable the static feature, and now including different versions, that use either the C or the rust -sys crate, all work together in the same build.

What's Changed

New Contributors

Full Changelog: trifectatechfoundation/bzip2-rs@v0.5.0...v0.5.1

Commits
  • 3032f37 Bump to 0.4.4
  • 90c9c18 Patched an infinite loop bug in src/mem.rs, impl Decompress::decompress() (#86)
  • 016e181 Bump versions
  • 2158f5a *: introduce static features (

@dependabot
chore(deps): bump the cargo group across 2 directories with 26 updates
5d901ec 
Bumps the cargo group with 11 updates in the /rust directory:

| Package | From | To |
| --- | --- | --- |
| [bumpalo](https://github.com/fitzgen/bumpalo) | `3.7.0` | `3.20.2` |
| [h2](https://github.com/hyperium/h2) | `0.3.4` | `0.3.27` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.0` | `0.1.6` |
| [mio](https://github.com/tokio-rs/mio) | `0.7.13` | `0.7.14` |
| [num-bigint](https://github.com/rust-num/num-bigint) | `0.4.1` | `0.4.3` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.36` | `0.10.76` |
| [regex](https://github.com/rust-lang/regex) | `1.5.4` | `1.5.5` |
| [tar](https://github.com/alexcrichton/tar-rs) | `0.4.37` | `0.4.45` |
| [time](https://github.com/time-rs/time) | `0.1.44` | `0.1.45` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.10.1` | `1.16.1` |
| [zeroize_derive](https://github.com/RustCrypto/utils) | `1.1.0` | `1.4.3` |

Bumps the cargo group with 6 updates in the /rust/auction/program directory:

| Package | From | To |
| --- | --- | --- |
| [borsh](https://github.com/near/borsh-rs) | `0.8.2` | `0.9.3` |
| [bumpalo](https://github.com/fitzgen/bumpalo) | `3.6.1` | `3.20.2` |
| [idna](https://github.com/servo/rust-url) | `0.2.2` | `0.2.3` |
| [time](https://github.com/time-rs/time) | `0.1.44` | `0.1.45` |
| [zeroize_derive](https://github.com/RustCrypto/utils) | `1.0.1` | `1.4.3` |
| [thread_local](https://github.com/Amanieu/thread_local-rs) | `1.1.3` | `1.1.9` |



Updates `bumpalo` from 3.7.0 to 3.20.2
- [Changelog](https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md)
- [Commits](fitzgen/bumpalo@3.7.0...v3.20.2)

Updates `h2` from 0.3.4 to 0.3.27
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/v0.3.27/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.4...v0.3.27)

Updates `keccak` from 0.1.0 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.0...keccak-v0.1.6)

Updates `mio` from 0.7.13 to 0.7.14
- [Release notes](https://github.com/tokio-rs/mio/releases)
- [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/mio@v0.7.13...v0.7.14)

Updates `num-bigint` from 0.4.1 to 0.4.3
- [Changelog](https://github.com/rust-num/num-bigint/blob/master/RELEASES.md)
- [Commits](rust-num/num-bigint@num-bigint-0.4.1...num-bigint-0.4.3)

Updates `openssl` from 0.10.36 to 0.10.76
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.36...openssl-v0.10.76)

Updates `regex` from 1.5.4 to 1.5.5
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.5.4...1.5.5)

Updates `tar` from 0.4.37 to 0.4.45
- [Commits](alexcrichton/tar-rs@0.4.37...0.4.45)

Updates `time` from 0.1.44 to 0.1.45
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](https://github.com/time-rs/time/commits)

Updates `tokio` from 1.10.1 to 1.16.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.10.1...tokio-1.16.1)

Updates `zeroize_derive` from 1.1.0 to 1.4.3
- [Changelog](https://github.com/RustCrypto/utils/blob/master/zeroize/CHANGELOG.md)
- [Commits](RustCrypto/utils@hex-literal-v1.1.0...zeroize_derive-v1.4.3)

Updates `borsh` from 0.8.2 to 0.9.3
- [Release notes](https://github.com/near/borsh-rs/releases)
- [Changelog](https://github.com/near/borsh-rs/blob/master/CHANGELOG.md)
- [Commits](near/borsh-rs@v0.8.2...v0.9.3)

Updates `bumpalo` from 3.6.1 to 3.20.2
- [Changelog](https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md)
- [Commits](fitzgen/bumpalo@3.7.0...v3.20.2)

Updates `bzip2` from 0.3.3 to 0.4.4
- [Release notes](https://github.com/trifectatechfoundation/bzip2-rs/releases)
- [Commits](trifectatechfoundation/bzip2-rs@0.3.3...0.4.4)

Updates `crossbeam-deque` from 0.7.3 to 0.8.6
- [Release notes](https://github.com/crossbeam-rs/crossbeam/releases)
- [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/master/CHANGELOG.md)
- [Commits](crossbeam-rs/crossbeam@crossbeam-0.7.3...crossbeam-deque-0.8.6)

Updates `crossbeam-utils` from 0.7.2 to 0.8.21
- [Release notes](https://github.com/crossbeam-rs/crossbeam/releases)
- [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/master/CHANGELOG.md)
- [Commits](crossbeam-rs/crossbeam@crossbeam-utils-0.7.2...crossbeam-utils-0.8.21)

Updates `curve25519-dalek` from 2.1.2 to 3.2.1
- [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases)
- [Commits](dalek-cryptography/curve25519-dalek@2.1.2...3.2.1)

Updates `generic-array` from 0.12.3 to 0.14.9
- [Release notes](https://github.com/fizyk20/generic-array/releases)
- [Changelog](https://github.com/fizyk20/generic-array/blob/master/CHANGELOG.md)
- [Commits](https://github.com/fizyk20/generic-array/commits)

Updates `h2` from 0.3.2 to 0.3.27
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/v0.3.27/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.4...v0.3.27)

Updates `idna` from 0.2.2 to 0.2.3
- [Release notes](https://github.com/servo/rust-url/releases)
- [Commits](servo/rust-url@idna-v0.2.2...idna-v0.2.3)

Updates `keccak` from 0.1.0 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.0...keccak-v0.1.6)

Updates `libsecp256k1` from 0.3.5 to 0.6.0
- [Changelog](https://github.com/paritytech/libsecp256k1/blob/master/CHANGELOG.md)
- [Commits](paritytech/libsecp256k1@v0.3.5...v0.6.0)

Updates `lock_api` from 0.3.4 to 0.4.14
- [Release notes](https://github.com/Amanieu/parking_lot/releases)
- [Changelog](https://github.com/Amanieu/parking_lot/blob/master/CHANGELOG.md)
- [Commits](Amanieu/parking_lot@lock_api-0.3.4...lock_api-v0.4.14)

Updates `memoffset` from 0.5.6 to 0.6.5
- [Changelog](https://github.com/Gilnaa/memoffset/blob/master/CHANGELOG.md)
- [Commits](Gilnaa/memoffset@v0.5.6...v0.6.5)

Updates `ouroboros` from 0.5.1 to 0.14.2
- [Commits](https://github.com/someguynamedjosh/ouroboros/commits/0.14.2)

Updates `regex` from 1.4.3 to 1.12.3
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.5.4...1.5.5)

Updates `ring` from 0.16.12 to 0.16.20
- [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md)
- [Commits](https://github.com/briansmith/ring/commits)

Updates `solana_rbpf` from 0.2.5 to 0.2.24
- [Release notes](https://github.com/solana-labs/rbpf/releases)
- [Commits](solana-labs/rbpf@v0.2.5...v0.2.24)

Updates `tar` from 0.4.33 to 0.4.45
- [Commits](alexcrichton/tar-rs@0.4.37...0.4.45)

Updates `time` from 0.1.44 to 0.1.45
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](https://github.com/time-rs/time/commits)

Updates `tokio` from 0.1.22 to 1.14.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.10.1...tokio-1.16.1)

Updates `webpki` from 0.21.2 to 0.22.4
- [Commits](https://github.com/briansmith/webpki/commits)

Updates `zeroize_derive` from 1.0.1 to 1.4.3
- [Changelog](https://github.com/RustCrypto/utils/blob/master/zeroize/CHANGELOG.md)
- [Commits](RustCrypto/utils@hex-literal-v1.1.0...zeroize_derive-v1.4.3)

Updates `thread_local` from 1.1.3 to 1.1.9
- [Release notes](https://github.com/Amanieu/thread_local-rs/releases)
- [Changelog](https://github.com/Amanieu/thread_local-rs/blob/master/CHANGELOG.md)
- [Commits](Amanieu/thread_local-rs@v1.1.3...v1.1.9)

---
updated-dependencies:
- dependency-name: bumpalo
  dependency-version: 3.20.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: h2
  dependency-version: 0.3.27
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: mio
  dependency-version: 0.7.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: num-bigint
  dependency-version: 0.4.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-version: 0.10.76
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: regex
  dependency-version: 1.5.5
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tar
  dependency-version: 0.4.45
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.1.45
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.16.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: zeroize_derive
  dependency-version: 1.4.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: borsh
  dependency-version: 0.9.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: bumpalo
  dependency-version: 3.20.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: bzip2
  dependency-version: 0.4.4
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: crossbeam-deque
  dependency-version: 0.8.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: crossbeam-utils
  dependency-version: 0.8.21
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: curve25519-dalek
  dependency-version: 3.2.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: generic-array
  dependency-version: 0.14.9
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: h2
  dependency-version: 0.3.27
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: idna
  dependency-version: 0.2.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: libsecp256k1
  dependency-version: 0.6.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: lock_api
  dependency-version: 0.4.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: memoffset
  dependency-version: 0.6.5
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ouroboros
  dependency-version: 0.14.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: regex
  dependency-version: 1.12.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ring
  dependency-version: 0.16.20
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: solana_rbpf
  dependency-version: 0.2.24
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tar
  dependency-version: 0.4.45
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.1.45
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.14.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: webpki
  dependency-version: 0.22.4
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: zeroize_derive
  dependency-version: 1.4.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: thread_local
  dependency-version: 1.1.9
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Mar 20, 2026
@dependabot dependabot bot mentioned this pull request Mar 20, 2026
Closed
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 20, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​thiserror@​1.0.24 ⏵ 1.0.6981 -1910093100100
Updatedcargo/​solana-sdk@​1.6.4 ⏵ 1.13.782 +3100100 +8100100
Updatedcargo/​solana-program@​1.6.4 ⏵ 1.13.789 +7100100 +8100100
Updatedcargo/​borsh@​0.8.2 ⏵ 0.9.31009990 -3100100
Addedcargo/​spl-token@​3.5.010010093100100
Updatedcargo/​solana-program-test@​1.6.4 ⏵ 1.13.79810093100100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 20, 2026

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
High CVE: Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing in cargo quinn-proto

CVE: GHSA-6xvm-j4wr-6v98 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing (HIGH)

Affected versions: < 0.11.14

Patched version: 0.11.14

From: ? → cargo/solana-program-test@1.13.7 → cargo/quinn-proto@0.8.4

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/quinn-proto@0.8.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo ahash

Location: Package overview

From: ? → cargo/borsh@0.9.3 → cargo/solana-program-test@1.13.7 → cargo/ahash@0.7.8

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/ahash@0.7.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo brotli

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/brotli@3.5.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/brotli@3.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo cc

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-program@1.13.7 → cargo/cc@1.2.57

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/cc@1.2.57. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo deranged

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/deranged@0.5.8

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/deranged@0.5.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo im

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-sdk@1.13.7 → cargo/solana-program@1.13.7 → cargo/im@15.1.0

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/im@15.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo js-sys

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-sdk@1.13.7 → cargo/solana-program@1.13.7 → cargo/js-sys@0.3.91

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/js-sys@0.3.91. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo js-sys

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-sdk@1.13.7 → cargo/solana-program@1.13.7 → cargo/js-sys@0.3.91

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/js-sys@0.3.91. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo lz4-sys

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/lz4-sys@1.11.1%2Blz4-1.10.0

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lz4-sys@1.11.1%2Blz4-1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo lz4-sys

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/lz4-sys@1.11.1%2Blz4-1.10.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lz4-sys@1.11.1%2Blz4-1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo nix

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/nix@0.23.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/nix@0.23.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo num-complex

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/num-complex@0.2.4

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/num-complex@0.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo num-complex

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/num-complex@0.2.4

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/num-complex@0.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo num-complex

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/num-complex@0.2.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/num-complex@0.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo num-rational

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/num-rational@0.2.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/num-rational@0.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo num-rational

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/num-rational@0.2.4

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/num-rational@0.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo oid-registry

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/oid-registry@0.6.1

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/oid-registry@0.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo quinn-proto

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/quinn-proto@0.8.4

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/quinn-proto@0.8.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo quote

Location: Package overview

From: ? → cargo/bincode@1.3.3 → cargo/borsh@0.9.3 → cargo/thiserror@1.0.69 → cargo/num-derive@0.3.3 → cargo/spl-token@3.5.0 → cargo/solana-program-test@1.13.7 → cargo/solana-sdk@1.13.7 → cargo/solana-program@1.13.7 → cargo/quote@1.0.45

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/quote@1.0.45. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo r-efi

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-program@1.13.7 → cargo/r-efi@5.3.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/r-efi@5.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo r-efi

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-program@1.13.7 → cargo/r-efi@5.3.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/r-efi@5.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo rayon

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-sdk@1.13.7 → cargo/solana-program@1.13.7 → cargo/rayon@1.11.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rayon@1.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: cargo rayon

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/solana-sdk@1.13.7 → cargo/solana-program@1.13.7 → cargo/rayon@1.11.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rayon@1.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo rcgen

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/rcgen@0.9.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rcgen@0.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo rustix

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/rustix@1.1.4

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rustix@1.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo rustls-native-certs

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/rustls-native-certs@0.6.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rustls-native-certs@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Native binaries present: cargo rustls

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/rustls@0.20.9

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rustls@0.20.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: cargo security-framework

Location: Package overview

From: ? → cargo/solana-program-test@1.13.7 → cargo/security-framework@2.11.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/security-framework@2.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 62 more rows in the dashboard

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants