Skip to contentistheinternetok

Is astral-sh/ruff OK?

Yes.

Nothing serious in what it ships.

Internal: 8 flaws in tests and tools, none reaches your users.

Checked 17:05 UTCcommit bfa2407advisories as of 16:50 UTC

Post on X

Touches your users

6 flaws in what the project ships, the gravest first.

Can expose your users' data or let someone take over

  • zip 8.6.03 flawsfixed in 9.0.0Someone could pass for another user. Only with access to the machine.
    • RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
    • RUSTSEC-2026-0369ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
    • RUSTSEC-2026-0368zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

Can break or slow your service

  • paste 1.0.151 flawA flaw whose effect is not spelled out.
  • proc-macro-error2 2.0.11 flawA flaw whose effect is not spelled out.
  • crossbeam-epoch 0.9.181 flawfixed in 0.9.20A flaw whose effect is not spelled out.
    • RUSTSEC-2026-0204Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

Internal only

Dev tools, tests, examples, docs and benchmarks: they do not reach your users, so they never count in the answer.

  • dompurify 3.4.155 flawsfixed in 3.4.17Someone could attack the people who use it. From anywhere online, no account needed.
    • GHSA-cg2g-xh64-v4q7DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
    • GHSA-mrv2-3pqr-j5jrDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
    • GHSA-p98j-92pf-mc4pDOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
    • GHSA-6688-9rhm-gjv2DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
    • GHSA-c6gr-qvv4-5v3fDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
  • undici 7.29.13 flawsfixed in 7.30.1Someone could change data or files. From anywhere online, no account needed.
    • GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
    • GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    • GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Email me when this changes

One email to confirm, then one only when the answer gets worse or a new serious flaw appears: at most one a day, at once if attackers use it. One click to unsubscribe.

Put the badge in your README

It shows this answer and changes with it.

Is astral-sh/ruff OK?
[![Is astral-sh/ruff OK?](https://istheinternetok.com/r/astral-sh/ruff/badge.svg)](https://istheinternetok.com/r/astral-sh/ruff/)

Read from Cargo.lock, crates/ty_completion_eval/truth/auto-import-includes-modules/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-current-module/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-third-party-tests/uv.lock, crates/ty_completion_eval/truth/class-arg-completion/uv.lock, crates/ty_completion_eval/truth/deprecated-deprioritized/uv.lock, crates/ty_completion_eval/truth/exact-over-fuzzy/uv.lock, crates/ty_completion_eval/truth/fstring-completions/uv.lock, crates/ty_completion_eval/truth/higher-level-symbols-preferred/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-dunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-sunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-type_check_only/uv.lock, crates/ty_completion_eval/truth/import-keyword-completion/uv.lock, crates/ty_completion_eval/truth/internal-typeshed-hidden/uv.lock, crates/ty_completion_eval/truth/local-over-auto-import/uv.lock, crates/ty_completion_eval/truth/modules-over-other-symbols/uv.lock, crates/ty_completion_eval/truth/none-completion/uv.lock, crates/ty_completion_eval/truth/numpy-array/uv.lock, crates/ty_completion_eval/truth/object-attr-instance-methods/uv.lock, crates/ty_completion_eval/truth/pass-keyword-completion/uv.lock, crates/ty_completion_eval/truth/raise-uses-base-exception/uv.lock, crates/ty_completion_eval/truth/scope-existing-over-new-import/uv.lock, crates/ty_completion_eval/truth/scope-prioritize-closer/uv.lock, crates/ty_completion_eval/truth/scope-simple-long-identifier/uv.lock, crates/ty_completion_eval/truth/stdlib-over-third-party-same-name/uv.lock, crates/ty_completion_eval/truth/tighter-over-looser-scope/uv.lock, crates/ty_completion_eval/truth/tstring-completions/uv.lock, crates/ty_completion_eval/truth/ty-extensions-lower-stdlib/uv.lock, crates/ty_completion_eval/truth/typing-gets-priority/uv.lock, crates/ty_completion_eval/truth/typing-only-auto-import-ranking/uv.lock, fuzz/Cargo.lock, playground/api/package-lock.json, playground/deploy/package-lock.json, playground/package-lock.json, python/py-fuzzer/uv.lock, python/ruff-ecosystem/uv.lock, scripts/benchmarks/uv.lock, scripts/ty_benchmark/package-lock.json, scripts/ty_benchmark/uv.lock, uv.lock.