Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Apr 14, 2025

This PR contains the following updates:

Package Type Update Change
tokio (source) dependencies patch 1.43.0 -> 1.43.1

GitHub Vulnerability Alerts

GHSA-rr8g-9fpq-6wmg

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.


Release Notes

tokio-rs/tokio (tokio)

v1.43.1

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies This updates dependency files label Apr 14, 2025
@raphael-goetz raphael-goetz merged commit 1eca64c into main Apr 14, 2025
1 check passed
@raphael-goetz raphael-goetz deleted the renovate/crate-tokio-vulnerability branch April 14, 2025 14:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies This updates dependency files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants