Headscracher/review-gate
Watch
1
0
Fork
You've already forked review-gate
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

🔒 Dependency Dashboard #2

New issue
Open
opened 2026-08-27 23:05:00 +00:00 by Headscracher · 0 comments
Headscracher commented 2026-08-27 23:05:00 +00:00
Owner
Copy link

🔒 Dependency Dashboard (7)

6 unknown · 1 moderate

Severity Package Installed Fixed in Advisory
⚫ Unknown glib 0.18.5 0.20.0 RUSTSEC-2024-0429
⚫ Unknown pin-utils 0.1.0 none yet RUSTSEC-2026-0441
⚫ Unknown proc-macro-error 1.0.4 none yet RUSTSEC-2024-0370
⚫ Unknown zbus_names 4.3.1 none yet RUSTSEC-2026-0371
⚫ Unknown zvariant 5.10.0 none yet RUSTSEC-2026-0370
⚫ Unknown zvariant_derive 5.10.0 none yet RUSTSEC-2026-0372
🟡 Moderate 6.9 glib 0.18.5 0.20.0 GHSA-wrw7-89jp-8q8g
glib 0.18.5 — Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`

The VariantStrIter::impl_get function (called internally by implementations of the Iterator and DoubleEndedIterator traits for this type) was unsound, resulting in undefined behaviour.

An immutable reference &p to a *mut libc::c_char pointer initialized to NULL was passed as an argument to a C function that that mutates the pointer behind &p in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through &p now seem to be completely disregarded when building the glib crate with optimizations.

This subsequently caused all calls of VariantStrIter::impl_get to violate the safety requirements of the std::ffi::CStr::from_ptr function - which requires its argument to be a valid pointer to a C-style string - resulting in crashes due to NULL pointer dereferences.

This was fixed by passing the out-argument pointer explitly as &mut p instead of &p.

This issue has been present since this code was initially added in glib v0.15.0. The mismatch in mutability was likely missed (and not raised as an error by the compiler) because the C function wrapped by VariantStrIter::impl_get is variadic (glib_sys::g_variant_get_child), and the pointer in question is one of the variadic arguments.

affected >=0.15.0 <0.20.0 · found in src-tauri/Cargo.lock

https://crates.io/crates/glib · https://rustsec.org/advisories/RUSTSEC-2024-0429.html · https://github.com/gtk-rs/gtk-rs-core/pull/1343

pin-utils 0.1.0 — `pin-utils` is unmaintained

The upstream repository was archived on October 1, 2026, after the
release of version 0.1.1.

For local pinning, replace pin_mut! with core::pin::pin!, available
since Rust 1.68. For pin projection, replace unsafe_pinned! and
unsafe_unpinned! with pin-project or pin-project-lite.

affected >=0.0.0-0 · found in src-tauri/Cargo.lock

https://crates.io/crates/pin-utils · https://rustsec.org/advisories/RUSTSEC-2026-0441.html · https://github.com/rust-lang/team/pull/2787 · https://github.com/rustsec/advisory-db/issues/3314

proc-macro-error 1.0.4 — proc-macro-error is unmaintained

proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.

proc-macro-error also depends on syn 1.x, which may be bringing duplicate dependencies into dependant build trees.

Possible Alternative(s)

affected >=0.0.0-0 · found in src-tauri/Cargo.lock

https://crates.io/crates/proc-macro-error · https://rustsec.org/advisories/RUSTSEC-2024-0370.html · https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20

zbus_names 4.3.1 — `zbus_names` is unmaintained

The zbus_names crate is no longer maintained as a standalone crate.

It has been merged into zbus starting with version 6.0.0, as its names module.

Users should migrate to zbus, with its default features disabled if they only need the D-Bus name types.

affected >=0.0.0-0 · found in src-tauri/Cargo.lock

https://crates.io/crates/zbus_names · https://rustsec.org/advisories/RUSTSEC-2026-0371.html · https://github.com/z-galaxy/zbus/issues/2043

zvariant 5.10.0 — `zvariant` is unmaintained

The zvariant crate is no longer maintained as a standalone crate.

It has been merged into zbus starting with version 6.0.0, as its wire module.

Users should migrate to zbus, with its default features disabled if they only need the D-Bus wire format. Users of the GVariant format should migrate to zgvariant.

affected >=0.0.0-0 · found in src-tauri/Cargo.lock

https://crates.io/crates/zvariant · https://rustsec.org/advisories/RUSTSEC-2026-0370.html · https://github.com/z-galaxy/zbus/issues/2043

zvariant_derive 5.10.0 — `zvariant_derive` is unmaintained

The zvariant_derive crate is no longer maintained as a standalone crate.

Its derive macros are provided by zbus starting with version 6.0.0.

Users should migrate to zbus, with its default features disabled if they only need the D-Bus wire format.

affected >=0.0.0-0 · found in src-tauri/Cargo.lock

https://crates.io/crates/zvariant_derive · https://rustsec.org/advisories/RUSTSEC-2026-0372.html · https://github.com/z-galaxy/zbus/issues/2043

glib 0.18.5 — Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`

The VariantStrIter::impl_get function (called internally by implementations of the Iterator and DoubleEndedIterator traits for this type) was unsound, resulting in undefined behaviour.

An immutable reference &p to a *mut libc::c_char pointer initialized to NULL was passed as an argument to a C function that that mutates the pointer behind &p in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through &p now seem to be completely disregarded when building the glib crate with optimizations.

This subsequently caused all calls of VariantStrIter::impl_get to violate the safety requirements of the std::ffi::CStr::from_ptr function - which requires its argument to be a valid pointer to a C-style string - resulting in crashes due to NULL pointer dereferences.

This was fixed by passing the out-argument pointer explitly as &mut p instead of &p.

This issue has been present since this code was initially added in glib v0.15.0. The mismatch in mutability was likely missed (and not raised as an error by the compiler) because the C function wrapped by VariantStrIter::impl_get is variadic (glib_sys::g_variant_get_child), and the pointer in question is one of the variadic arguments.

affected >=0.15.0 <0.20.0 · found in src-tauri/Cargo.lock

https://github.com/gtk-rs/gtk-rs-core/pull/1343 · https://github.com/gtk-rs/gtk-rs-core · https://rustsec.org/advisories/RUSTSEC-2024-0429.html

Scanned 2 lockfile(s) · 2026-11-05 09:00 UTC · dependabork

<!-- dependabork:v1 --> <!-- hash:3284483da7e1515b --> # 🔒 Dependency Dashboard (7) **6 unknown · 1 moderate** | Severity | Package | Installed | Fixed in | Advisory | |---|---|---|---|---| | ⚫ Unknown | glib | 0.18.5 | 0.20.0 | [RUSTSEC-2024-0429](https://osv.dev/vulnerability/RUSTSEC-2024-0429) | | ⚫ Unknown | pin-utils | 0.1.0 | **none yet** | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | | ⚫ Unknown | proc-macro-error | 1.0.4 | **none yet** | [RUSTSEC-2024-0370](https://osv.dev/vulnerability/RUSTSEC-2024-0370) | | ⚫ Unknown | zbus_names | 4.3.1 | **none yet** | [RUSTSEC-2026-0371](https://osv.dev/vulnerability/RUSTSEC-2026-0371) | | ⚫ Unknown | zvariant | 5.10.0 | **none yet** | [RUSTSEC-2026-0370](https://osv.dev/vulnerability/RUSTSEC-2026-0370) | | ⚫ Unknown | zvariant_derive | 5.10.0 | **none yet** | [RUSTSEC-2026-0372](https://osv.dev/vulnerability/RUSTSEC-2026-0372) | | 🟡 Moderate 6.9 | glib | 0.18.5 | 0.20.0 | [GHSA-wrw7-89jp-8q8g](https://osv.dev/vulnerability/GHSA-wrw7-89jp-8q8g) | <details><summary>glib 0.18.5 — Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`</summary> The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable reference `&p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `&p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `&p` now seem to be completely disregarded when building the `glib` crate with optimizations. This subsequently caused all calls of `VariantStrIter::impl_get` to violate the safety requirements of the `std::ffi::CStr::from_ptr` function - which requires its argument to be a valid pointer to a C-style string - resulting in crashes due to `NULL` pointer dereferences. This was fixed by passing the out-argument pointer explitly as `&mut p` instead of `&p`. This issue has been present since this code was initially added in `glib` v0.15.0. The mismatch in mutability was likely missed (and not raised as an error by the compiler) because the C function wrapped by `VariantStrIter::impl_get` is variadic (`glib_sys::g_variant_get_child`), and the pointer in question is one of the variadic arguments. affected `>=0.15.0 <0.20.0` · found in `src-tauri/Cargo.lock` <https://crates.io/crates/glib> · <https://rustsec.org/advisories/RUSTSEC-2024-0429.html> · <https://github.com/gtk-rs/gtk-rs-core/pull/1343> </details> <details><summary>pin-utils 0.1.0 — `pin-utils` is unmaintained</summary> The [upstream repository] was archived on October 1, 2026, after the release of version 0.1.1. For local pinning, replace `pin_mut!` with [`core::pin::pin!`], available since Rust 1.68. For pin projection, replace `unsafe_pinned!` and `unsafe_unpinned!` with [`pin-project`] or [`pin-project-lite`]. [upstream repository]: https://github.com/rust-lang/pin-utils [`core::pin::pin!`]: https://doc.rust-lang.org/core/pin/macro.pin.html [`pin-project`]: https://crates.io/crates/pin-project [`pin-project-lite`]: https://crates.io/crates/pin-project-lite affected `>=0.0.0-0` · found in `src-tauri/Cargo.lock` <https://crates.io/crates/pin-utils> · <https://rustsec.org/advisories/RUSTSEC-2026-0441.html> · <https://github.com/rust-lang/team/pull/2787> · <https://github.com/rustsec/advisory-db/issues/3314> </details> <details><summary>proc-macro-error 1.0.4 — proc-macro-error is unmaintained</summary> proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email. proc-macro-error also depends on `syn 1.x`, which may be bringing duplicate dependencies into dependant build trees. ## Possible Alternative(s) - [manyhow](https://crates.io/crates/manyhow) - [proc-macro2-diagnostics](https://github.com/SergioBenitez/proc-macro2-diagnostics) affected `>=0.0.0-0` · found in `src-tauri/Cargo.lock` <https://crates.io/crates/proc-macro-error> · <https://rustsec.org/advisories/RUSTSEC-2024-0370.html> · <https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20> </details> <details><summary>zbus_names 4.3.1 — `zbus_names` is unmaintained</summary> The `zbus_names` crate is no longer maintained as a standalone crate. It has been merged into [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`, as its `names` module. Users should migrate to [`zbus`](https://crates.io/crates/zbus), with its default features disabled if they only need the D-Bus name types. affected `>=0.0.0-0` · found in `src-tauri/Cargo.lock` <https://crates.io/crates/zbus_names> · <https://rustsec.org/advisories/RUSTSEC-2026-0371.html> · <https://github.com/z-galaxy/zbus/issues/2043> </details> <details><summary>zvariant 5.10.0 — `zvariant` is unmaintained</summary> The `zvariant` crate is no longer maintained as a standalone crate. It has been merged into [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`, as its `wire` module. Users should migrate to [`zbus`](https://crates.io/crates/zbus), with its default features disabled if they only need the D-Bus wire format. Users of the GVariant format should migrate to [`zgvariant`](https://crates.io/crates/zgvariant). affected `>=0.0.0-0` · found in `src-tauri/Cargo.lock` <https://crates.io/crates/zvariant> · <https://rustsec.org/advisories/RUSTSEC-2026-0370.html> · <https://github.com/z-galaxy/zbus/issues/2043> </details> <details><summary>zvariant_derive 5.10.0 — `zvariant_derive` is unmaintained</summary> The `zvariant_derive` crate is no longer maintained as a standalone crate. Its derive macros are provided by [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`. Users should migrate to [`zbus`](https://crates.io/crates/zbus), with its default features disabled if they only need the D-Bus wire format. affected `>=0.0.0-0` · found in `src-tauri/Cargo.lock` <https://crates.io/crates/zvariant_derive> · <https://rustsec.org/advisories/RUSTSEC-2026-0372.html> · <https://github.com/z-galaxy/zbus/issues/2043> </details> <details><summary>glib 0.18.5 — Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`</summary> The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable reference `&p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `&p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `&p` now seem to be completely disregarded when building the `glib` crate with optimizations. This subsequently caused all calls of `VariantStrIter::impl_get` to violate the safety requirements of the `std::ffi::CStr::from_ptr` function - which requires its argument to be a valid pointer to a C-style string - resulting in crashes due to `NULL` pointer dereferences. This was fixed by passing the out-argument pointer explitly as `&mut p` instead of `&p`. This issue has been present since this code was initially added in `glib` v0.15.0. The mismatch in mutability was likely missed (and not raised as an error by the compiler) because the C function wrapped by `VariantStrIter::impl_get` is variadic (`glib_sys::g_variant_get_child`), and the pointer in question is one of the variadic arguments. affected `>=0.15.0 <0.20.0` · found in `src-tauri/Cargo.lock` <https://github.com/gtk-rs/gtk-rs-core/pull/1343> · <https://github.com/gtk-rs/gtk-rs-core> · <https://rustsec.org/advisories/RUSTSEC-2024-0429.html> </details> --- _Scanned 2 lockfile(s) · 2026-11-05 09:00 UTC · dependabork_
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
dependabork
Dependency vulnerabilities found by dependabork

No labels
dependabork
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Headscracher/review-gate#2
No description provided.