Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update rust crate conquer-once to 0.3.0 [security] #79

Merged
merged 1 commit into from
Nov 16, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 15, 2024

This PR contains the following updates:

Package Type Update Change
conquer-once dependencies minor 0.2.0 -> 0.3.0

GitHub Vulnerability Alerts

CVE-2020-36208

Affected versions of conquer-once implements Sync for its OnceCell type without restricting it to Sendable types.

This allows non-Send but Sync types such as MutexGuard to be sent across threads leading to undefined behavior and memory corruption in concurrent programs.

The issue was fixed by adding a Send constraint to OnceCell.


Release Notes

oliver-giersch/conquer-once (conquer-once)

v0.3.2

Compare Source

  • fixes potential UB due to insufficiently strict bounds on Sync implementation for OnceCell (see Issue #​3)

v0.3.1

Compare Source

  • fixes an apparent regression, requiring a new compiler than the stated 1.36.0

v0.3.0

  • mostly internal refactorings
  • adds the noblock module containing types which only allow non-blocking
    initialization
  • raw is renamed to doc and hidden from documentation, but linked to from
    within the docs
  • the Spin marker type is no longer exported
Release 0.3.1
  • fixes an apparent regression, requiring a new compiler than the stated 1.36.0
Release 0.3.2
  • fixes potential UB due to insufficiently strict bounds on Sync implementation for OnceCell (see Issue #​3)
Release 0.3.3
  • improves and clarifies wording of public documentation
  • improves internal documentation around all uses of unsafe code

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@Blindspot22 Blindspot22 self-requested a review November 16, 2024 21:24
@Blindspot22 Blindspot22 merged commit 1ab6554 into main Nov 16, 2024
1 check passed
@renovate renovate bot deleted the renovate/crate-conquer-once-vulnerability branch November 16, 2024 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant