cargo-audit

What's Changed

• Disable embedded file timestamps in rust-embed by @kpcyrd in #1554
• rustsec: avoid warning about packages that are not from crates.io by @djc in #1573
• cargo-audit: add CLI option to skip checking for yanked crates by @djc in #1574
• cargo-audit: cap input size for audit bin by @glaziermag in #1516
• Show affected functions in binaries by @smoelius in #1542
• cargo-audit: when run with -q, suppress dependency trees by @djc in #1587
• build(deps): bump object from 0.38.1 to 0.39.0 by @dependabot[bot] in #1589
• Affected binary tweaks by @djc in #1588

Fixed

• Upgraded to rustsec v0.30.2 to fix an incompatibility with Rust v1.85 and later (#1333)

Fixed

• Upgraded cargo-lock to fix an issue with Cargo.lock v4 format parsing in presence of git tags (#1298)
• Fix handling of the database.fetch configuration option (#1302)

Added

• V4 lockfile support (#1275)
• cargo audit bin can now audit WebAssembly (#1182)
• cargo audit now honors the CARGO_TERM_COLOR environment variable (#1207)
• Allow specifying multiple --target-os and --target-arch flags (#1185)

Changed

• Bump auditable-info => 0.8; auditable-serde => v0.7 (#1229)
• Bump abscissa to v0.8 (#1262)
• Bump rustsec to v0.30; adds V4 lockfile support (#1275)

Fixed

• Fix build for cargo install --locked by bumping time crate in Cargo.lock to work around a breaking change in rustc.

Changed

• Completely rewritten cargo audit fix subcommand (#1113)
  • Now it edits Cargo.lock as opposed to Cargo.toml, and performs only semver-compatible upgrades.
  • Fixes are performed by calling cargo update, migrating away from the unmaintained cargo-edit-9 crate.
  • The subcommand is still experimental, and its behavior may change in the future. It still requires enabling the non-default fix feature.
• Require tame-index 0.9.3 or later, fixing issues with some enterprise firewalls. (#1103)

Fixed

• Fix --color=auto always printing terminal escape sequences (#1057)

Changed

• Display the chain of errors instead of just the top-level error for more complete error reporting (#1063)
• Upgrade to clap 4.x and abscissa-core 0.7.x. This may have introduced minor changes to the command-line interface. This is the reason for the minor version bump. (#1092)

Fixed

• Fix a deadlock when the Cargo.lock file is missing. It only occurs with rustsec v0.28.3 or later. (#1051)

Fixed

• Fix RUSTSEC-2023-0064 security issue by requiring rustsec 0.28.2 or higher.

Fixed

• Release workflow: don't enable fix and vendored-openssl features (#980)

Added

• Implement proper attribution for advisories licensed under CC-BY (#955)
• cargo audit bin no longer shows warnings not applicable to the binary type (e.g. no more reports of Windows-only unsoundness in ELF binaries). Previously this was implemented for vulnerabilities, but not warnings. (#964)

Changed

• Upgraded to rustsec v0.28, bringing performance, security and compatibility improvements, but also temporarily dropping support for CPU platforms other than x86 and ARM. See the rustsec changelog for details.

Added

• Upgraded to cargo-lock v9.0.0, which enables support for sparse registries.
• When scanning binary files, the binary's platform is taken into account. This prevents scenarios such as Windows-only vulnerabilities being reported on Linux binaries ([#814])

Fixed

• Advisories about cargo audit itself are no longer printed multiple times when scanning multiple files (#848)

Added

• Vulnerability severity is now included in the cargo audit output, if known (#825)

Changed

• Advisories marked informational = unsound are now reported by default, but only as warnings (#819). They do not cause the audit to fail, i.e. the exit code of the process is still 0. This behavior can be suppressed through the configuration file.

Fixed

• The help text now correctly refers to the command as cargo audit instead of cargo audit audit (#824)
• The --version argument now works correctly, reporting the current version (#838)

Fixed

• Checks for yanked crates were broken since 0.17.0. This release restores them and adds tests to prevent future regressions.

Changed

• Binary scanning is enabled by default and documented as such. It can still be disabled by disabling the binary-scanning feature.

Added

• cargo audit bin now attempts to detect dependencies in binaries not built with cargo auditable by parsing the panic messages (#729). This only detects about a half of the dependency list and never detects C code such as OpenSSL, but works on any Rust binaries built with cargo.
• Added integration tests for the --deny=warnings flag.

Fixed

• cargo audit bin --deny=warnings no longer exits after finding the first binary with warnings.

Changed

• Up to 5x faster cargo audit bin when scanning multiple files thanks to caching crates.io index lookups (implemented in rustsec crate).
• Notices about cargo audit or rustsec will now result in a scanning error being reported (exit code 2) as opposed to reporting them as vulnerabilities in the scanned binary (exit code 1). They are treated as warnings by default, so --deny=warnings is required to observe the new behavior.
• The binary-scanning feature that adds the cargo audit bin subcommand is now enabled by default, but is not documented as such.

Changed

• Fixed the screenshot URL in README.md

Added

• Initial support for scanning binaries built with cargo auditable

Changed

• Update Abscissa to 0.6; replace gumdrop with clap v3 (#525)
• 2021 edition upgrade (#539)
• MSRV 1.57 (#539, #574)
• Bump rustsec to v0.26 (#574)

Fixed

• Terminal output fixups (#570)

Removed

• Unused lazy_static from dependencies (#500)
• Deprecated --deny-warnings CLI option (#545)

Changed

• Bump rustsec dependency to v0.25; MSRV 1.52 (#480)

Fixed

• Parse --color=auto correctly (#436)

Added

• vendored-libgit2 feature (#432)

Changed

• Pin thiserror and zeroize to avoid MSRV breakages (#415)

Added

• New exit status (2) for Cargo.lock parsing errors (#368)

Changed

• Bump rustsec crate dependency to v0.24 (#388)

Added

• Generate release builds with github actions (#337)

Changed

• Bump rustsec from 0.23.2 to 0.23.3 (#333)

Changed

• When running in no-fetch mode, allow accessing a non-git repo (#315)
• Enable informational warnings with deny (#320)
• Bump rustsec dependency to v0.23 (#327)
• MSRV 1.46+ (#327)

Changed

• Split -D/--deny and --deny-warnings (#278)
• Bump rustsec crate to v0.22.2 ([#277])

Fixed

• JSON serialization ([#277])

Added

• Support for project specific config directories (#252)

Changed

• Bump rustsec crate to v0.22; MSRV 1.41+ (#271)
• JSON report format changes (#271)
• Presenter improvements (#268)
• Make warning types an argument (#206)

Fixed

• fix --dry-run no longer requires argument (#231)

• Pin smol_str to v0.1.16 to ensure MSRV 1.41 compatibility (#255, #258)

• Update rustsec crate to v0.20 (#221)
• Regenerate lockfile after cargo audit fix (#219)
• Update dependencies; MSRV 1.40+ (#216)

• Improve yanked crate auditing messages and config (#200)
• Fix -c/--color command line argument (#199)

• Add vendored-openssl feature (#193)

• Update rustsec crate to v0.17 release; MSRV 1.39+ (#186, #188)
• Warn for yanked crates (#180)
• Respect sources of dependencies when auditing (#175)
• Upgrade to abscissa v0.5 (#174)
• cargo audit fix subcommand (#157, #166, #181)

• Upgrade rustsec to v0.16; new self-audit system (#155)
• Upgrade to Abscissa v0.4; MSRV 1.36 (#154)

• Update to rustsec crate v0.15.2 (#149)
• presenter: Cleanups for informational advisories (#148)
• presenter: Print better message when no solution is available (#144)

• Update to rustsec crate v0.15 (#138)

• Update to rustsec crate v0.14.1 (#134)

• Add --deny-warnings option (#128)
• Upgrade to rustsec crate v0.14 (#126)
• Configuration file: ~/.cargo/audit.toml (#123, #125)
• Fix --help (#113)
• Warn for outdated rustsec crate versions (#112)
• Display warnings for select informational advisories (#110)
• Display dependency trees with each advisory (#109)

• Fix --version (#101)

• Use the Abscissa application framework (#85, #87, #92, #94)
• Implement --no-fetch (#97)
• Add support for reading lockfiles from STDIN (#98)

• Switch from term to termcolor crate (#83)
• Update gumdrop to v0.6, rustsec crate to v0.12; min Rust 1.32+ (#82)
• Produce valid JSON when no vulnerabilities are detected (#77)
• Implement --ignore option (#75)

• Fix option parsing (#64)

• Update to Rust 2018 edition (#61)
• Update to rustsec crate v0.10 (#59)
• Prevent --help from exiting with error (#57)
• Add --json flag for JSON output (#41)

• Have cargo audit version exit with status 0 (#38)

• Refactoring and UI improvements (#37)

• Upgrade rustsec crate to 0.9 (#36)

• Honor the affected_platforms attribute (#35)
• Update rustsec crate dependency to 0.8 series (#34)
• Update term crate dependency to 0.5 series (#31)

• README.md: Use <img> tag for screenshot so it renders on crates.io (#28)

• Use OR delimiter to display patched versions (#25)
• Fix cargo audit --version (#24)

• Near rewrite of cargo-audit using rustsec 0.7.0 (#22)

• Use crate isatty to resolve Windows build errors (#14)

• Upgrade to rustsec 0.6.0 crate (#12)
• Configurable colors (#10)
• Avoid panicking if there are no dependencies (#8)
• Handle error and instruct the user to generate a lockfile before audit (#6)

• Make cargo-audit a proper cargo subcommand (#2)

• Initial release