astral-sh/ruff 还好吗？

好。

它发布的内容里没有大问题。

内部：测试和工具里有 8 个漏洞，都不会影响你的用户。

17:06 UTC检查提交 bfa2407公告截至 16:50 UTC

发布到 X

影响你的用户

项目发布的内容里有 6 个漏洞，最严重的在前。

可能泄露用户数据，或让人接管

zip 8.6.03 个漏洞已在 9.0.0 中修复有人可以冒充其他用户。必须能接触到这台机器。
- RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
- RUSTSEC-2026-0369ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
- RUSTSEC-2026-0368zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory

可能让你的服务崩溃或变慢

paste 1.0.151 个漏洞一个影响未说明的漏洞。
- RUSTSEC-2024-0436paste - no longer maintained
proc-macro-error2 2.0.11 个漏洞一个影响未说明的漏洞。
- RUSTSEC-2026-0173proc-macro-error2 is unmaintained
crossbeam-epoch 0.9.181 个漏洞已在 0.9.20 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0204Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

仅内部

开发工具、测试、示例、文档和基准测试：它们不会影响你的用户，所以从不计入答案。

dompurify 3.4.155 个漏洞已在 3.4.17 中修复有人可以攻击使用它的人。从网上任何地方都行，不需要账号。
- GHSA-cg2g-xh64-v4q7DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- GHSA-mrv2-3pqr-j5jrDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- GHSA-p98j-92pf-mc4pDOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
- GHSA-6688-9rhm-gjv2DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
- GHSA-c6gr-qvv4-5v3fDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
undici 7.29.13 个漏洞已在 7.30.1 中修复有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
- GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

有变化时发邮件给我

先发一封邮件请你确认，之后只在结论变差或出现新的严重漏洞时才发：每天最多一封，若攻击者正在利用则立即发送。一键退订。

把徽章放进你的 README

它显示这个答案，并随答案变化。

[![astral-sh/ruff 还好吗？](https://istheinternetok.com/r/astral-sh/ruff/badge.svg)](https://istheinternetok.com/r/astral-sh/ruff/)

读取自 Cargo.lock, crates/ty_completion_eval/truth/auto-import-includes-modules/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-current-module/uv.lock, crates/ty_completion_eval/truth/auto-import-skips-third-party-tests/uv.lock, crates/ty_completion_eval/truth/class-arg-completion/uv.lock, crates/ty_completion_eval/truth/deprecated-deprioritized/uv.lock, crates/ty_completion_eval/truth/exact-over-fuzzy/uv.lock, crates/ty_completion_eval/truth/fstring-completions/uv.lock, crates/ty_completion_eval/truth/higher-level-symbols-preferred/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-dunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-sunder/uv.lock, crates/ty_completion_eval/truth/import-deprioritizes-type_check_only/uv.lock, crates/ty_completion_eval/truth/import-keyword-completion/uv.lock, crates/ty_completion_eval/truth/internal-typeshed-hidden/uv.lock, crates/ty_completion_eval/truth/local-over-auto-import/uv.lock, crates/ty_completion_eval/truth/modules-over-other-symbols/uv.lock, crates/ty_completion_eval/truth/none-completion/uv.lock, crates/ty_completion_eval/truth/numpy-array/uv.lock, crates/ty_completion_eval/truth/object-attr-instance-methods/uv.lock, crates/ty_completion_eval/truth/pass-keyword-completion/uv.lock, crates/ty_completion_eval/truth/raise-uses-base-exception/uv.lock, crates/ty_completion_eval/truth/scope-existing-over-new-import/uv.lock, crates/ty_completion_eval/truth/scope-prioritize-closer/uv.lock, crates/ty_completion_eval/truth/scope-simple-long-identifier/uv.lock, crates/ty_completion_eval/truth/stdlib-over-third-party-same-name/uv.lock, crates/ty_completion_eval/truth/tighter-over-looser-scope/uv.lock, crates/ty_completion_eval/truth/tstring-completions/uv.lock, crates/ty_completion_eval/truth/ty-extensions-lower-stdlib/uv.lock, crates/ty_completion_eval/truth/typing-gets-priority/uv.lock, crates/ty_completion_eval/truth/typing-only-auto-import-ranking/uv.lock, fuzz/Cargo.lock, playground/api/package-lock.json, playground/deploy/package-lock.json, playground/package-lock.json, python/py-fuzzer/uv.lock, python/ruff-ecosystem/uv.lock, scripts/benchmarks/uv.lock, scripts/ty_benchmark/package-lock.json, scripts/ty_benchmark/uv.lock, uv.lock。