Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 15, 2024

This PR contains the following updates:

Package Type Update Change
conquer-once dependencies minor 0.2.0 -> 0.3.0

GitHub Vulnerability Alerts

CVE-2020-36208

Affected versions of conquer-once implements Sync for its OnceCell type without restricting it to Sendable types.

This allows non-Send but Sync types such as MutexGuard to be sent across threads leading to undefined behavior and memory corruption in concurrent programs.

The issue was fixed by adding a Send constraint to OnceCell.


Release Notes

oliver-giersch/conquer-once (conquer-once)

v0.3.2

Compare Source

  • fixes potential UB due to insufficiently strict bounds on Sync implementation for OnceCell (see Issue #​3)

v0.3.1

Compare Source

  • fixes an apparent regression, requiring a new compiler than the stated 1.36.0

v0.3.0

  • mostly internal refactorings
  • adds the noblock module containing types which only allow non-blocking
    initialization
  • raw is renamed to doc and hidden from documentation, but linked to from
    within the docs
  • the Spin marker type is no longer exported
Release 0.3.1
  • fixes an apparent regression, requiring a new compiler than the stated 1.36.0
Release 0.3.2
  • fixes potential UB due to insufficiently strict bounds on Sync implementation for OnceCell (see Issue #​3)
Release 0.3.3
  • improves and clarifies wording of public documentation
  • improves internal documentation around all uses of unsafe code

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@Blindspot22 Blindspot22 self-requested a review November 16, 2024 21:24
@Blindspot22 Blindspot22 merged commit 1ab6554 into main Nov 16, 2024
1 check passed
@renovate renovate bot deleted the renovate/crate-conquer-once-vulnerability branch November 16, 2024 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant