rustsec

What's Changed

• Sort paths in lint function by @smoelius in #1544
• build(deps): bump toml from 0.9.11+spec-1.1.0 to 1.0.1+spec-1.1.0 by @dependabot[bot] in #1547
• build(deps): bump gix from 0.78.0 to 0.79.0 by @dependabot[bot] in #1539
• build(deps): bump gix from 0.79.0 to 0.80.0 by @dependabot[bot] in #1553
• Add malicious as an explicit category by @LawnGnome in #1559
• Upgrade to gix 0.81 by @djc in #1564
• rustsec: avoid warning about packages that are not from crates.io by @djc in #1573
• build(deps): bump gix from 0.81.0 to 0.83.0 by @dependabot[bot] in #1594
• print the invalid char when linting affected functions by @Skgland in #1598
• Validate advisory dates with jiff crate by @waamm in #1603
• build(deps): bump gix from 0.83.0 to 0.84.0 by @dependabot[bot] in #1605
• admin: make ID assignment stricter by @djc in #1608

Fixed

• Upgraded to tame-index v0.18.1 to fix an incompatibility with Rust 1.85 and later (#1333)

Added

• Added public APIs for scanning binary files that were previously private to cargo audit (#1291)

Fixed

• Fixed OSV spec compliance issue with schema version being serialized as null if not set (#1287)
• Upgraded cargo-lock to fix an issue with Cargo.lock v4 format parsing in presence of git tags (#1298)

Changed

• MSRV 1.73 (#1222)
• Bump cargo-lock to v0.10; adds V4 lockfile support (#1224, #1264)
• Bump gix to 0.66 (#1251)
• Bump tame-index to v0.14 (#1251)

Changed

• Upgraded to gix v0.62. This fixes RUSTSEC-2024-0335. It also transitively upgrades to reqwest v0.12 and hyper v1.0. (#1174)

Changed

• Upgraded to gix v0.60. This fixes build issues due to a semver-incompatible change in the interaction of gix and tame-index. (#1143)

Changed

• Completely rewritten the fix module. (#1113)
  • Now it edits Cargo.lock as opposed to Cargo.toml, and performs only semver-compatible upgrades.
  • Fixes are performed by calling cargo update, migrating away from the unmaintained cargo-edit-9 crate.
  • The fix feature is removed and the module is always enabled now that it requires no additional dependencies.
  • The module is still experimental, and its behavior may change in the future.
• Require tame-index 0.9.3 or later, which fixes issues with some enterprise firewalls. (#1103)

Changed

• Additions to the OSV advisory struct (#656)
  • Add the schema_version field to OsvAdvisory
  • Add a Deserialize implementation for OsvAdvisory
  • Add getter methods for OsvAdvisory content

Changed

• Upgraded dependencies gix to 0.58.x and tame-index to 0.9.x (#1099)

Changed

• Switched from Git-compatible lockfiles to locks provided by the operating system. This fixes issues around stale lockfiles being left behind on power loss. (#1032)
• CachedIndex now acquires the global Cargo package lock. This was necessary to avoid racing with Cargo when updating crates.io index via Git or writing sparse index entries. Note that this also prevents most Cargo operations for the current user until CachedIndex is dropped. (#1032)
• The gix crate is now used in the max-performance-safe configuration, enabling multi-threading. (#1045)

Added

• The Severity type now implements Hash (#1042)

Fixed

• Upgraded to tame-index 0.6.0 and gix 0.53.1 to fix a vulnerability in gix, see RUSTSEC-2023-0064 (#1015)
• Correctly report error when encountering a stale git lockfile (#1012)

Changed

• No longer require HTTP/2 for accessing sparse crates.io index. This degrades performance somewhat due to an additional roundtrip to crates.io, but allows index access through corporate transparent proxies that do not support HTTP/2. (#992)

Fixed

• Fixed a performance regression where the cached crates.io index would re-request items that are already cached (#987)

Added

• Sparse crates.io index is now supported. This dramatically speeds up the checks for yanked crates. This crate honors the Cargo settings for the use of sparse index, should you need to opt out. (#923)
• Added directory locking and explicit locking controls to the API to avoid several processes modifying local data at the same time. (#923, #944)
• Added affected field to Warning, to communicate e.g. warnings specific to a particular platform. (#964)
• Added license field to the advisory format in preparation for data import from GHSA. (#682)
• Added a CommitHash type to represent git commit hashes independently from the git implementation used. (#961)

Changed

• Switched from OpenSSL to rustls as the TLS implementation. (#923, #925)
  • Due to this change CPU platforms other than x86 and ARM are no longer supported. This issue is tracked as #962.
  • The fix feature is not yet converted; enabling it will pull in OpenSSL.
• Switched from libgit2 to gitoxide as the git implementation. (#925)
• Switched from crates-index to tame-index for crates.io access. (#923)
• Increased the minimum supported rust version to 1.67. (#923)

Removed

• Removed rustsec::registry::Index because it is impractically slow when the sparse crates.io index is used. Use rustsec::registry::CachedIndex instead. (#923)
• Removed rustsec::registry::CachedIndex.is_yanked(). Use .find_yanked() instead. Checking a large number of crates at once is orders of magnitude faster when using the sparse index. (#937)
• Removed many From implementations from rustsec::Error to avoid tying rustsec SemVer to that of dependency crates. This should result in less frequent SemVer bumps for rustsec in the future. (#961)

Fixed

• rustsec can now be used in Alpine Linux containers (#466).
• Several users of rustsec running in parallel can now fetch Git repositories without races (#490).
• Accessing Git repositories over SSH is now supported (#292).
• Credential helpers to access private repositories are now supported #555.
• Fix an edge case in git source dependency resolution when dependencies differ only in their hash. (#889)

Added

• Upgraded to cargo-lock v9.0.0, which enables support for sparse registries.

Changed

• Migrated to a maintained fork of cargo-edit v0.9.x to fix CVE-2023-22742 in the transitive dependency libgit2-sys (#831)
• Removed the experimental check for the presence of a signature on the advisory-db repository. It only verified the presence of a signature without checking for any particular key, so it provided no additional security. (#816)
• Fixed a build failure with certain dependency versions on recent compilers due to failing type inference (#836)

Changed

• Migrated to a maintained fork of cargo-edit v0.9.x to fix CVE-2023-22742 in the transitive dependency libgit2-sys (#831)
• Removed the experimental check for the presence of a signature on the advisory-db repository. It only verified the presence of a signature without checking for any particular key, so it provided no additional security. (#816)
• Fixed a build failure with certain dependency versions on recent compilers due to failing type inference (#836)

Fixed

• registry::CachedIndex now correctly handles invalid semver versions in crates.io registry, which crates.io allows for some reason (#762)

Added

• registry::CachedIndex which is orders of magnitude faster than registry::Index when scanning multiple Cargo.lock files or binaries (#730)

Fixed

• Fixed withdrawn (#642)

Changed

• Deprecate yanked (#631)

Added

• [advisory.source] (#541)
• doc_cfg annotations when building on docs.rs (#571)

Changed

• Bump git2 dependency to v0.14; MSRV 1.57 (#524)
• Bump platforms dependency to v3.0 (#532)
• Update to 2021 edition (#538)
• Use Query::crate_scope() as the Default (#544)
• Bump cvss dependency to v2.0 (#550)
• Bump cargo-lock dependency to v8.0 (#561)
• Flatten warnings module; rename WarningKind (#572)
• Flatten advisory::id module; rename IdKind (#573)

Removed

• Legacy database scopes (#541)

Changed

• Bump platforms dependency to v2.0.0 (#485)

Changed

• Bump cargo-edit dependency from 0.7.0 to 0.8.0 (#439)
• Make advisory::id::Kind lowercase (#471)
• Bump MSRV to 1.52 (#476)
• Flatten API: make modules with one type non-pub; re-export type from parent (#478)

Added

• vendored-libgit2 feature (#432)

Changed

• OSV v1.0 (#421)

Changed

• Support ~ and = operators in version specification (#402)
• Bump crates-index from 0.16.7 to 0.17.0 (#403)

Changed

• Do not lint year in CVE IDs (#393)

Added

• OSV export (#366)

Changed

• Bump cargo-lock to v7.0 (#379)

Fixed

• Workaround for stale git refs

Changed

• Rename advisory-db master branch to main

Fixed

• Parsing error on Windows

Added

• Advisory references as a URL list
• Support for omitting leading [advisory] table
• thread-safety category

Changed

• Rename previous references field to related
• Use url crate to parse metadata URL
• Bump smol_str to v0.1.17; MSRV 1.46+
• Replace chrono with humantime
• Mark enums as non_exhaustive
• Use SystemTime instead of a git::Timestamp type
• Rename fetch Cargo feature to git
• Rename repository::GitRepository to repository::git::Repository

Removed

• markdown feature

What's Changed

• Disable embedded file timestamps in rust-embed by @kpcyrd in #1554
• rustsec: avoid warning about packages that are not from crates.io by @djc in #1573
• cargo-audit: add CLI option to skip checking for yanked crates by @djc in #1574
• cargo-audit: cap input size for audit bin by @glaziermag in #1516
• Show affected functions in binaries by @smoelius in #1542
• cargo-audit: when run with -q, suppress dependency trees by @djc in #1587
• build(deps): bump object from 0.38.1 to 0.39.0 by @dependabot[bot] in #1589
• Affected binary tweaks by @djc in #1588

Changed

• Revert "Refactor Advisory type handling"

Changed

• Refactor Advisory and VulnerabilityInfo

Added

• fetch feature

Changed

• Bump cargo-lock to v6; semver to v0.11
• Make advisory.title and advisory.description struct fields
• Remove support for the V2 advisory format
• Mark the advisory::parser module as pub
• Bump cargo-edit to 0.7.0
• Bump crates-index from 0.15.4 to 0.16.0
• advisory: laxer function path handling
• linter: fully deprecate obsolete in favor of yanked
• advisory: markdown feature and Advisory::description_html
• linter: add support for V3 advisory format
• MSRV 1.41+
• Bump platforms crate to v1

Fixed

• linter: correctly handle crates with dashes in names

Removed

• advisory.metadata.title and advisory.metadata.description

Added

• year, month, and day methods to advisory::Date
• unsound informational advisory kind

Changed

• Bump crates-index from 0.14 to 0.15
• Rename obsolete advisories to yanked
• Rename warning::Kind::Informational to ::Notice
• Make warning::Kind a #[non_exhausive] enum
• Make Informational a #[non_exhausive] enum

Removed

• Legacy patched_versions and unaffected_versions

Added

• advisory::Id::numerical_part()

Changed

• Make WarningInfo into a simple type alias

• Refactor package scopes
• Prototype V3 Advisory Format
• Bump dependencies to link libgit2 dynamically
• Add WarningInfo and modify Warning struct
• Drop support for the V1 advisory format

• Move yanked crate auditing to cargo-audit

• Update cargo-lock requirement from 3.0 to 4.0

• Bump MSRV to 1.39
• Extract cargo audit fix logic into Fixer
• Warn for yanked crates
• Add vendored-openssl feature
• Support crate sources as a vulnerability query attribute
• Try to auto-detect proxy setting

• Remove support.toml parsing

• version: Fix matching bug for > version requirements

• linter: Add informational as an allowable [advisory] key
• repository: Expose authentication module

• Upgrade to cargo-lock crate v3.0

• Upgrade to cargo-lock crate v2.0

• warning: Extract into module; make more like Vulnerability
• Upgrade to cvss crate v1.0
• Upgrade to cargo-lock crate v1.0

• linter: Ensure advisory date's year matches year in advisory ID
• Use the cargo-lock crate
• lockfile: Add (optional) DependencyGraph analysis
• Rename rustsec::db module to rustsec::database
• report: Generate warnings for selected informational advisories
• vulnerability: Add affected_functions()
• Add rustsec::advisory::Linter
• package: Parse dependencies from Cargo.lock
• Initial report module and built-in report-generating
• Basic query support
• Index the rust advisory directory from RustSec/advisory-db
• Add first-class support for GitHub Security Advisories (GHSA)
• Re-vendor Cargo's git authentication code
• support.toml for indicating supported versions
• Add support for "informational" advisories
• Add rustsec::advisory::Category
• Refactor advisory types: add [affected] and [versions] sections
• advisory: Add (optional) cvss field with CVSS v3.1 score
• Freshen deps: add home, remove directories and failure
• Improved handling of prereleases; MSRV 1.35+
• Add Version and VersionReq newtypes