본문으로 건너뛰기istheinternetok

astral-sh/ruff 괜찮나요?

네.

배포하는 것에 심각한 문제는 없습니다.

내부: 테스트와 도구에 결함 8개, 어느 것도 사용자에게 닿지 않습니다.

17:05 UTC 확인커밋 bfa240716:50 UTC 기준 보안 권고

X에 게시

사용자에게 닿는 것

프로젝트가 배포하는 것에 결함 6개, 심각한 것부터.

사용자 데이터가 노출되거나 누군가 장악할 수 있음

  • zip 8.6.0결함 3개9.0.0에서 수정됨누군가 다른 사용자를 사칭할 수 있습니다. 기기에 접근할 수 있어야만.
    • RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
    • RUSTSEC-2026-0369ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
    • RUSTSEC-2026-0368zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

서비스가 멈추거나 느려질 수 있음

  • paste 1.0.15결함 1개영향이 명시되지 않은 결함입니다.
  • proc-macro-error2 2.0.1결함 1개영향이 명시되지 않은 결함입니다.
  • crossbeam-epoch 0.9.18결함 1개0.9.20에서 수정됨영향이 명시되지 않은 결함입니다.
    • RUSTSEC-2026-0204Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

내부 전용

개발 도구, 테스트, 예제, 문서, 벤치마크: 사용자에게 닿지 않으므로 답에는 넣지 않습니다.

  • dompurify 3.4.15결함 5개3.4.17에서 수정됨누군가 이것을 쓰는 사람들을 공격할 수 있습니다. 인터넷 어디서나, 계정 없이도.
    • GHSA-cg2g-xh64-v4q7DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
    • GHSA-mrv2-3pqr-j5jrDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
    • GHSA-p98j-92pf-mc4pDOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
    • GHSA-6688-9rhm-gjv2DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
    • GHSA-c6gr-qvv4-5v3fDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
  • undici 7.29.1결함 3개7.30.1에서 수정됨누군가 데이터나 파일을 바꿀 수 있습니다. 인터넷 어디서나, 계정 없이도.
    • GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
    • GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    • GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

바뀌면 이메일로 알려 주세요

확인용 이메일 한 통을 보낸 뒤, 답이 나빠지거나 새로운 심각한 결함이 생길 때만 보냅니다. 하루에 많아야 한 통, 공격에 쓰이고 있으면 바로 보냅니다. 수신 거부는 클릭 한 번.

README에 배지 넣기

이 답을 보여 주고, 답이 바뀌면 함께 바뀝니다.

astral-sh/ruff 괜찮나요?
[![astral-sh/ruff 괜찮나요?](https://istheinternetok.com/r/astral-sh/ruff/badge.svg)](https://istheinternetok.com/r/astral-sh/ruff/)

읽은 파일: Cargo.lock, crates/ty_completion_eval/truth/auto-import-includes-modules/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-current-module/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-third-party-tests/uv.lock, crates/ty_completion_eval/truth/class-arg-completion/uv.lock, crates/ty_completion_eval/truth/deprecated-deprioritized/uv.lock, crates/ty_completion_eval/truth/exact-over-fuzzy/uv.lock, crates/ty_completion_eval/truth/fstring-completions/uv.lock, crates/ty_completion_eval/truth/higher-level-symbols-preferred/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-dunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-sunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-type_check_only/uv.lock, crates/ty_completion_eval/truth/import-keyword-completion/uv.lock, crates/ty_completion_eval/truth/internal-typeshed-hidden/uv.lock, crates/ty_completion_eval/truth/local-over-auto-import/uv.lock, crates/ty_completion_eval/truth/modules-over-other-symbols/uv.lock, crates/ty_completion_eval/truth/none-completion/uv.lock, crates/ty_completion_eval/truth/numpy-array/uv.lock, crates/ty_completion_eval/truth/object-attr-instance-methods/uv.lock, crates/ty_completion_eval/truth/pass-keyword-completion/uv.lock, crates/ty_completion_eval/truth/raise-uses-base-exception/uv.lock, crates/ty_completion_eval/truth/scope-existing-over-new-import/uv.lock, crates/ty_completion_eval/truth/scope-prioritize-closer/uv.lock, crates/ty_completion_eval/truth/scope-simple-long-identifier/uv.lock, crates/ty_completion_eval/truth/stdlib-over-third-party-same-name/uv.lock, crates/ty_completion_eval/truth/tighter-over-looser-scope/uv.lock, crates/ty_completion_eval/truth/tstring-completions/uv.lock, crates/ty_completion_eval/truth/ty-extensions-lower-stdlib/uv.lock, crates/ty_completion_eval/truth/typing-gets-priority/uv.lock, crates/ty_completion_eval/truth/typing-only-auto-import-ranking/uv.lock, fuzz/Cargo.lock, playground/api/package-lock.json, playground/deploy/package-lock.json, playground/package-lock.json, python/py-fuzzer/uv.lock, python/ruff-ecosystem/uv.lock, scripts/benchmarks/uv.lock, scripts/ty_benchmark/package-lock.json, scripts/ty_benchmark/uv.lock, uv.lock.