Vai al contenutoistheinternetok

astral-sh/ruff sta bene?

Sì.

Niente di grave in quello che distribuisce.

Interno: 8 falle in test e strumenti, nessuna raggiunge i tuoi utenti.

Controllato 17:05 UTCcommit bfa2407avvisi aggiornati: 16:50 UTC

Pubblica su X

Tocca i tuoi utenti

6 falle in quello che il progetto distribuisce, le più gravi prima.

Può esporre i dati dei tuoi utenti o far prendere il controllo a qualcuno

  • zip 8.6.03 fallecorretto in 9.0.0Qualcuno potrebbe spacciarsi per un altro utente. Solo con accesso alla macchina.
    • RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
    • RUSTSEC-2026-0369ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
    • RUSTSEC-2026-0368zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

Può rompere o rallentare il tuo servizio

  • paste 1.0.151 fallaUna falla il cui effetto non è specificato.
  • proc-macro-error2 2.0.11 fallaUna falla il cui effetto non è specificato.
  • crossbeam-epoch 0.9.181 fallacorretto in 0.9.20Una falla il cui effetto non è specificato.
    • RUSTSEC-2026-0204Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

Solo interno

Strumenti di sviluppo, test, esempi, documentazione e benchmark: non raggiungono i tuoi utenti, quindi non contano mai nella risposta.

  • dompurify 3.4.155 fallecorretto in 3.4.17Qualcuno potrebbe attaccare le persone che lo usano. Da qualsiasi punto di internet, senza account.
    • GHSA-cg2g-xh64-v4q7DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
    • GHSA-mrv2-3pqr-j5jrDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
    • GHSA-p98j-92pf-mc4pDOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
    • GHSA-6688-9rhm-gjv2DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
    • GHSA-c6gr-qvv4-5v3fDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
  • undici 7.29.13 fallecorretto in 7.30.1Qualcuno potrebbe modificare dati o file. Da qualsiasi punto di internet, senza account.
    • GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
    • GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    • GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Avvisami via email quando cambia

Un'email per confermare, poi una solo quando la risposta peggiora o compare una nuova falla grave: al massimo una al giorno, subito se gli aggressori la usano. Un clic per disiscriversi.

Metti il badge nel tuo README

Mostra questa risposta e cambia insieme a lei.

astral-sh/ruff sta bene?
[![astral-sh/ruff sta bene?](https://istheinternetok.com/r/astral-sh/ruff/badge.svg)](https://istheinternetok.com/r/astral-sh/ruff/)

Letto da Cargo.lock, crates/ty_completion_eval/truth/auto-import-includes-modules/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-current-module/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-third-party-tests/uv.lock, crates/ty_completion_eval/truth/class-arg-completion/uv.lock, crates/ty_completion_eval/truth/deprecated-deprioritized/uv.lock, crates/ty_completion_eval/truth/exact-over-fuzzy/uv.lock, crates/ty_completion_eval/truth/fstring-completions/uv.lock, crates/ty_completion_eval/truth/higher-level-symbols-preferred/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-dunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-sunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-type_check_only/uv.lock, crates/ty_completion_eval/truth/import-keyword-completion/uv.lock, crates/ty_completion_eval/truth/internal-typeshed-hidden/uv.lock, crates/ty_completion_eval/truth/local-over-auto-import/uv.lock, crates/ty_completion_eval/truth/modules-over-other-symbols/uv.lock, crates/ty_completion_eval/truth/none-completion/uv.lock, crates/ty_completion_eval/truth/numpy-array/uv.lock, crates/ty_completion_eval/truth/object-attr-instance-methods/uv.lock, crates/ty_completion_eval/truth/pass-keyword-completion/uv.lock, crates/ty_completion_eval/truth/raise-uses-base-exception/uv.lock, crates/ty_completion_eval/truth/scope-existing-over-new-import/uv.lock, crates/ty_completion_eval/truth/scope-prioritize-closer/uv.lock, crates/ty_completion_eval/truth/scope-simple-long-identifier/uv.lock, crates/ty_completion_eval/truth/stdlib-over-third-party-same-name/uv.lock, crates/ty_completion_eval/truth/tighter-over-looser-scope/uv.lock, crates/ty_completion_eval/truth/tstring-completions/uv.lock, crates/ty_completion_eval/truth/ty-extensions-lower-stdlib/uv.lock, crates/ty_completion_eval/truth/typing-gets-priority/uv.lock, crates/ty_completion_eval/truth/typing-only-auto-import-ranking/uv.lock, fuzz/Cargo.lock, playground/api/package-lock.json, playground/deploy/package-lock.json, playground/package-lock.json, python/py-fuzzer/uv.lock, python/ruff-ecosystem/uv.lock, scripts/benchmarks/uv.lock, scripts/ty_benchmark/package-lock.json, scripts/ty_benchmark/uv.lock, uv.lock.