¿Está bien astral-sh/ruff?
Sí.
Nada grave en lo que distribuye.
Interno: 8 fallos en pruebas y herramientas, ninguno llega a tus usuarios.Comprobado 17:06 UTCcommit bfa2407avisos actualizados: 16:50 UTC
Afecta a tus usuarios
6 fallos en lo que distribuye el proyecto, los más graves primero.
Puede exponer los datos de tus usuarios o dejar que alguien tome el control
zip 8.6.03 falloscorregido en 9.0.0Alguien podría hacerse pasar por otro usuario. Solo con acceso a la máquina.
- RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
- RUSTSEC-2026-0369ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
- RUSTSEC-2026-0368zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
Puede romper o ralentizar tu servicio
paste 1.0.151 falloUn fallo cuyo efecto no se detalla.
- RUSTSEC-2024-0436paste - no longer maintained
proc-macro-error2 2.0.11 falloUn fallo cuyo efecto no se detalla.
- RUSTSEC-2026-0173proc-macro-error2 is unmaintained
crossbeam-epoch 0.9.181 fallocorregido en 0.9.20Un fallo cuyo efecto no se detalla.
- RUSTSEC-2026-0204Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
Solo interno
Herramientas de desarrollo, pruebas, ejemplos, documentación y benchmarks: no llegan a tus usuarios, así que nunca cuentan en la respuesta.
dompurify 3.4.155 falloscorregido en 3.4.17Alguien podría atacar a la gente que lo usa. Desde cualquier lugar de internet, sin cuenta.
- GHSA-cg2g-xh64-v4q7DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- GHSA-mrv2-3pqr-j5jrDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- GHSA-p98j-92pf-mc4pDOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
- GHSA-6688-9rhm-gjv2DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
- GHSA-c6gr-qvv4-5v3fDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
undici 7.29.13 falloscorregido en 7.30.1Alguien podría cambiar datos o archivos. Desde cualquier lugar de internet, sin cuenta.
- GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
Avísame por email cuando cambie
Un email para confirmar, y luego uno solo cuando la respuesta empeore o aparezca un fallo grave nuevo: como mucho uno al día, al momento si los atacantes lo usan. Un clic para darte de baja.
Pon la insignia en tu README
Muestra esta respuesta y cambia con ella.
[](https://istheinternetok.com/r/astral-sh/ruff/)Leído de Cargo.lock, crates/ty_completion_eval/truth/auto-import-includes-modules/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-current-module/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-third-party-tests/uv.lock, crates/ty_completion_eval/truth/class-arg-completion/uv.lock, crates/ty_completion_eval/truth/deprecated-deprioritized/uv.lock, crates/ty_completion_eval/truth/exact-over-fuzzy/uv.lock, crates/ty_completion_eval/truth/fstring-completions/uv.lock, crates/ty_completion_eval/truth/higher-level-symbols-preferred/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-dunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-sunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-type_check_only/uv.lock, crates/ty_completion_eval/truth/import-keyword-completion/uv.lock, crates/ty_completion_eval/truth/internal-typeshed-hidden/uv.lock, crates/ty_completion_eval/truth/local-over-auto-import/uv.lock, crates/ty_completion_eval/truth/modules-over-other-symbols/uv.lock, crates/ty_completion_eval/truth/none-completion/uv.lock, crates/ty_completion_eval/truth/numpy-array/uv.lock, crates/ty_completion_eval/truth/object-attr-instance-methods/uv.lock, crates/ty_completion_eval/truth/pass-keyword-completion/uv.lock, crates/ty_completion_eval/truth/raise-uses-base-exception/uv.lock, crates/ty_completion_eval/truth/scope-existing-over-new-import/uv.lock, crates/ty_completion_eval/truth/scope-prioritize-closer/uv.lock, crates/ty_completion_eval/truth/scope-simple-long-identifier/uv.lock, crates/ty_completion_eval/truth/stdlib-over-third-party-same-name/uv.lock, crates/ty_completion_eval/truth/tighter-over-looser-scope/uv.lock, crates/ty_completion_eval/truth/tstring-completions/uv.lock, crates/ty_completion_eval/truth/ty-extensions-lower-stdlib/uv.lock, crates/ty_completion_eval/truth/typing-gets-priority/uv.lock, crates/ty_completion_eval/truth/typing-only-auto-import-ranking/uv.lock, fuzz/Cargo.lock, playground/api/package-lock.json, playground/deploy/package-lock.json, playground/package-lock.json, python/py-fuzzer/uv.lock, python/ruff-ecosystem/uv.lock, scripts/benchmarks/uv.lock, scripts/ty_benchmark/package-lock.json, scripts/ty_benchmark/uv.lock, uv.lock.