Skip to content

run: Process::new() should take &[Str] instead of &[~str] for args#8203

Closed
lilyball wants to merge 1 commit into
rust-lang:masterfrom
lilyball:process-new-args
Closed

run: Process::new() should take &[Str] instead of &[~str] for args#8203
lilyball wants to merge 1 commit into
rust-lang:masterfrom
lilyball:process-new-args

Conversation

@lilyball

@lilyball lilyball commented Aug 1, 2013

Copy link
Copy Markdown
Contributor

Fixes #7928.

As a side-effect, this no longer clones all the arg strings on unix.

@lilyball

lilyball commented Aug 2, 2013

Copy link
Copy Markdown
Contributor Author

@graydon: Upon thinking more about the ugly code in with_argv I'm no longer convinced that my replacement is safe. Specifically, as_c_str may actually copy the string if it's not null-terminated, and provide a pointer to that copied string. I suspect I may have to go ahead and use my new into_owned() so I can then use as_bytes_with_null() instead, although this will mean copying strings even if they were null-terminated to begin with.

Alternatively I could reimplement as_c_str() but have it return (Option<~str>, *libc::c_char) instead, which would let me hold onto the temporary if one was constructed.

Thoughts?

@lilyball

lilyball commented Aug 2, 2013

Copy link
Copy Markdown
Contributor Author

@graydon: I deleted your r+ comment due to the above issue.

@lilyball

lilyball commented Aug 2, 2013

Copy link
Copy Markdown
Contributor Author

@graydon: r? I fixed with_argv to only copy arguments when necessary.

@graydon

graydon commented Aug 2, 2013

Copy link
Copy Markdown
Contributor

Needs a rebase. Otherwise r=me, yeah. This is something I thought wouldn't be a problem at first since you were asking about a code change when the incoming values were all ~str and then I overlooked that later you were using it as a way to abstract it to take Str. Sorry.

@lilyball

lilyball commented Aug 2, 2013

Copy link
Copy Markdown
Contributor Author

r? @graydon

bors added a commit that referenced this pull request Aug 3, 2013
The method .into_owned() is meant to be used as an optimization when you
need to get a ~str from a Str, but don't want to unnecessarily copy it
if it's already a ~str.

This is meant to ease functions that look like

  fn foo<S: Str>(strs: &[S])

Previously they could work with the strings as slices using .as_slice(),
but producing ~str required copying the string, even if the vector
turned out be a &[~str] already.

I don't have any concrete uses for this yet, since the one conversion I've done to `&[S]` so far (see PR #8203) didn't actually need owned strings. But having this here may make using `Str` more attractive.

It also may be worth adding an `into_managed()` function, but that one is less obviously useful than `into_owned()`.
@graydon

graydon commented Aug 6, 2013

Copy link
Copy Markdown
Contributor

The bad news is that we just (today) agreed to take the patch that removes the trailing nulls from slices and sets their length back to always cover only valid chars. This means that (a) you'll always need to copy and (b) if you use that probe-one-past-the-end code you copied and pasted in here, it'll start causing memory faults.

Sorry about this mess. Confusion around the trailing nulls is exactly the thing we are trying to get rid of, by removing the feature.

@lilyball

lilyball commented Aug 6, 2013

Copy link
Copy Markdown
Contributor Author

Holding this patch until #8296 lands, at which point I will rewrite this on top of it.

@lilyball

Copy link
Copy Markdown
Contributor Author

Rewritten on top of #8296. r? @graydon

@lilyball

Copy link
Copy Markdown
Contributor Author

@graydon There was one error in librust, which I didn't catch because I only ran the libstd tests instead of doing a full build. My bad. r?

@lilyball

Copy link
Copy Markdown
Contributor Author

Rebased yet again.

@catamorphism

Copy link
Copy Markdown
Contributor

@kballard Needs rebase (and the test failure may be legitimate, I'm not sure)

@lilyball

Copy link
Copy Markdown
Contributor Author

Rebased. Don't understand the test failures though. Nothing I did should affect Windows linkage, or should add calls to Windows functions that weren't previously used.

@lilyball

Copy link
Copy Markdown
Contributor Author

I have no idea what's causing the Windows failures:

error: linking with `g++` failed with code 1
note: g++ arguments: -Lc:\bot\slave\auto-win-32-nopt-t\build\obj\i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin -m32 -o i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra-a7c050cfd46b2c9a-0.8-pre.dll i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o -Lc:\bot\slave\auto-win-32-nopt-t\build\obj\i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin -lstd-6c65cf4b443341b1-0.8-pre -Lc:\bot\slave\auto-win-32-nopt-t\build\obj\.rust -Lc:\bot\slave\auto-win-32-nopt-t\build\obj -shared -lmorestack -lrustrt
note: i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8d83c): undefined reference to `GetCurrentProcess'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8d963): undefined reference to `DuplicateHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8db74): undefined reference to `DuplicateHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8dd85): undefined reference to `DuplicateHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8eb67): undefined reference to `CloseHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8eb79): undefined reference to `CloseHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8eb8b): undefined reference to `CloseHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8ec50): undefined reference to `CloseHandle'
i686-pc-mingw32\stage1\bin\rustc\i686-pc-mingw32\bin\extra.o:fake:(.text+0x8f031): undefined reference to `CreateProcessA'
collect2: ld returned 1 exit status

@lilyball

Copy link
Copy Markdown
Contributor Author

The referenced calls are all used in spawn_process_os(). The only change I made to that function was changing the type of the args arg from &[~str] to &[S] where S: Str.

@catamorphism

Copy link
Copy Markdown
Contributor

@kballard Needs a rebase in any case.

@lilyball

Copy link
Copy Markdown
Contributor Author

@catamorphism I can rebase it yet again, but that won't solve the windows problem. My best guess right now is that there's something going on here where the fact that it's generic means that libstd isn't actually linking against the FFI functions (because it contains the AST for the function instead of the actual compiled executable code), and then when libextra tries to call it, it hits the undefined symbols.

@lilyball

Copy link
Copy Markdown
Contributor Author

It appears that process spawning has changed significantly. I'm going to re-write this PR on top of the new approach, but I don't know if the Windows issue will continue to happen. I wish I had some way of testing without going through the full r+ process.

@lilyball

Copy link
Copy Markdown
Contributor Author

Looks like the new approach no longer defines the Windows FFI functions as part of the process stuff, instead relying on libuv to deal with it, so I hope that means it won't happen again.

@lilyball

Copy link
Copy Markdown
Contributor Author

I have a rewritten version now that passes the stage2 libstd tests, but I'm running make check before pushing it.

@lilyball

Copy link
Copy Markdown
Contributor Author

Don't review yet. Pushing here because I'm having a compilation issue.

@lilyball

Copy link
Copy Markdown
Contributor Author

Ok this new commit passes make check. Sadly I had to leave run::process_status() as taking &[~str], because of the ICE in #8835.

@lilyball

Copy link
Copy Markdown
Contributor Author

r?

@lilyball

Copy link
Copy Markdown
Contributor Author

@alexcrichton Why was it reverted? Was that the source of the crashes on the builders?

Anyway, going back to the previous implementation of this is just going to bring back the Windows test failures. My guess right now is there's a problem with declaring extern fns inside a generic fn. I could try refactoring those declarations to be outside the generic fn, but I have no way of test Windows short of going through the whole r+ -> full make check process again.

@alexcrichton

Copy link
Copy Markdown
Member

It was both the source of a massive regression on windows and I also suspect that it was causing all the segfaults.

For you extern fn inside a generic fn problem, I'd be interested in seeing if #8843 fixes that issue.

@lilyball

Copy link
Copy Markdown
Contributor Author

Rebased. This presumably is going to require #8843 to work on Windows though.

@huonw

huonw commented Aug 30, 2013

Copy link
Copy Markdown
Contributor

@kballard #8843 has now landed.

@lilyball

Copy link
Copy Markdown
Contributor Author

@huonw Great. This can be reviewed again now.

@lilyball

Copy link
Copy Markdown
Contributor Author

Damn. #8843 didn't fix it.

@catamorphism

Copy link
Copy Markdown
Contributor

Closing due to lack of activity. Please reopen a new pull request if you get the chance to work on this more -- thanks!

@lilyball

Copy link
Copy Markdown
Contributor Author

It seems #9055 may be the cause of the Windows errors.

@lilyball
lilyball deleted the process-new-args branch May 16, 2014 02:21
flip1995 pushed a commit to flip1995/rust that referenced this pull request Jan 17, 2022
New lint: `iter_overeager_cloned`

Closes rust-lang#8202

changelog: New lint: [`iter_overeager_cloned`]
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jun 18, 2026
…kout-6.x, r=marcoieni

Update actions/checkout action to v6

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5` → `v6.0.3` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3)

- Fix checkout init for SHA-256 repositories by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2439](https://redirect.github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2414](https://redirect.github.com/actions/checkout/pull/2414)

### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2)

- Fix tag handling: preserve annotations and explicit fetch-tags by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2356](https://redirect.github.com/actions/checkout/pull/2356)

### [`v6.0.1`](https://redirect.github.com/actions/checkout/compare/v6.0.0...v6.0.1)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1)

### [`v6.0.0`](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6.0.0)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6)

### [`v5.0.1`](https://redirect.github.com/actions/checkout/releases/tag/v5.0.1)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1)

##### What's Changed

- Port v6 cleanup to v5 by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2301](https://redirect.github.com/actions/checkout/pull/2301)

**Full Changelog**: <actions/checkout@v5...v5.0.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jun 21, 2026
…load-artifact-8.x, r=Mark-Simulacrum

Update actions/download-artifact action to v8.0.1

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8` → `v8.0.1` |

---

### Release Notes

<details>
<summary>actions/download-artifact (actions/download-artifact)</summary>

### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1)

[Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1)

#### What's Changed

- Support for CJK characters in the artifact name by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;471](https://redirect.github.com/actions/download-artifact/pull/471)
- Add a regression test for artifact name + content-type mismatches by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;472](https://redirect.github.com/actions/download-artifact/pull/472)

**Full Changelog**: <actions/download-artifact@v8...v8.0.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jun 21, 2026
…load-artifact-8.x, r=Mark-Simulacrum

Update actions/download-artifact action to v8.0.1

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8` → `v8.0.1` |

---

### Release Notes

<details>
<summary>actions/download-artifact (actions/download-artifact)</summary>

### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1)

[Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1)

#### What's Changed

- Support for CJK characters in the artifact name by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;471](https://redirect.github.com/actions/download-artifact/pull/471)
- Add a regression test for artifact name + content-type mismatches by [@&rust-lang#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&rust-lang#8203;472](https://redirect.github.com/actions/download-artifact/pull/472)

**Full Changelog**: <actions/download-artifact@v8...v8.0.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
rust-timer added a commit that referenced this pull request Jun 22, 2026
Rollup merge of #158108 - renovate-bot:renovate/actions-download-artifact-8.x, r=Mark-Simulacrum

Update actions/download-artifact action to v8.0.1

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8` → `v8.0.1` |

---

### Release Notes

<details>
<summary>actions/download-artifact (actions/download-artifact)</summary>

### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1)

[Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1)

#### What's Changed

- Support for CJK characters in the artifact name by [@&#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&#8203;471](https://redirect.github.com/actions/download-artifact/pull/471)
- Add a regression test for artifact name + content-type mismatches by [@&#8203;danwkennedy](https://redirect.github.com/danwkennedy) in [#&#8203;472](https://redirect.github.com/actions/download-artifact/pull/472)

**Full Changelog**: <actions/download-artifact@v8...v8.0.1>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…ulnerability, r=jieyouxu

Update Rust crate rand to v0.9.3 [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dependencies | patch | `0.9.2` → `0.9.3` |
| [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dev-dependencies | patch | `0.9.2` → `0.9.3` |

---

### Rand is unsound with a custom logger using rand::rng()
[GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc)

<details>
<summary>More information</summary>

#### Details
It has been reported (by @&rust-lang#8203;lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:

- The `log` and `thread_rng` features are enabled
- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
- The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
- Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed

`TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.

#### Severity
Low

#### References
- [https://github.com/rust-random/rand/pull/1763](https://redirect.github.com/rust-random/rand/pull/1763)
- [https://rustsec.org/advisories/RUSTSEC-2026-0097.html](https://rustsec.org/advisories/RUSTSEC-2026-0097.html)
- [https://github.com/advisories/GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>rust-random/rand (rand)</summary>

### [`v0.9.3`](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3)

[Compare Source](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…lnerability, r=jieyouxu

Update Rust crate tar to v0.4.46 [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [tar](https://redirect.github.com/composefs/tar-rs) | dependencies | patch | `0.4.45` → `0.4.46` |

---

### tar has a PAX header desynchronization issue
[GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2)

<details>
<summary>More information</summary>

#### Details
##### Summary

When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.

[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the "pax Header Block" section for the specific prescription there.

As a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header's `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers.

##### PoC

[This tar](https://redirect.github.com/user-attachments/files/27141941/pax-overrides-extension-header.tar.zip) (zipped for size) demonstrates the desynchronization: with `tar tvf`:

```
% tar tvf tests/archives/pax-overrides-extension-header.tar
----------  0 0      0        2048 Dec 31  1969 longname.txt
----------  0 0      0           0 Dec 31  1969 file_b
```

with `tar-rs`:

```
---- pax_size_does_not_apply_to_extension_headers stdout ----

thread 'pax_size_does_not_apply_to_extension_headers' (250476889) panicked at tests/all.rs:2121:27:
called `Result::unwrap()` on an `Err` value: Custom { kind: Other, error: "numeric field was not a number: AAAAAAAA when getting cksum for AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
```

In the above case, the PoC is not weaponized, so it jumps into the middle of an entry and subsequently fails the checksum test rather than silently continuing with attacker-controlled archive state.

##### Impact

This is very similar to GHSA-j5gw-2vrg-8fgx and GHSA-fp55-jw48-c537 in impact -- an attacker can use this to extract (or not extract) files from a tar stream depending on the tar parser used, which in turn can be used to obscure the presence of malicious files.

#### Severity
Medium

#### References
- [https://github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2)
- [https://github.com/composefs/tar-rs/pull/454](https://redirect.github.com/composefs/tar-rs/pull/454)
- [https://github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838](https://redirect.github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838)
- [https://github.com/composefs/tar-rs/releases/tag/0.4.46](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)
- [https://github.com/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>composefs/tar-rs (tar)</summary>

### [`v0.4.46`](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)

[Compare Source](https://redirect.github.com/composefs/tar-rs/compare/0.4.45...0.4.46)

#### Security

- archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;454](https://redirect.github.com/composefs/tar-rs/pull/454)

See also <GHSA-3cv2-h65g-fgmm>

#### Other changes

- ci: Fix and re-enable reverse dependency testing by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;444](https://redirect.github.com/composefs/tar-rs/pull/444)
- Update astral-tokio-tar requirement from 0.5 to 0.6 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446)
- Update some links by [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445)
- Add support of absolute paths by [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426)
- docs: Expand notes on concurrent mutations and following symlinks by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;453](https://redirect.github.com/composefs/tar-rs/pull/453)
- Update repo links by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;451](https://redirect.github.com/composefs/tar-rs/pull/451)
- ci: Add crates.io trusted publishing workflow by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;456](https://redirect.github.com/composefs/tar-rs/pull/456)
- Release 0.4.46 by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;455](https://redirect.github.com/composefs/tar-rs/pull/455)

#### New Contributors

- [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] made their first contribution in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446)
- [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) made their first contribution in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445)
- [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) made their first contribution in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426)

**Full Changelog**: <composefs/tar-rs@0.4.45...0.4.46>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…g-subscriber-vulnerability, r=jieyouxu

Update Rust crate tracing-subscriber [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` |
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` |
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` |

---

###  Tracing logging user input may result in poisoning logs with ANSI escape sequences
[CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5)

<details>
<summary>More information</summary>

#### Details
##### Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

- Manipulate terminal title bars
- Clear screens or modify terminal display
- Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

##### Patches

`tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

##### Workarounds

Avoid printing logs to terminal emulators without escaping ANSI control sequences.

##### References

https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/

##### Acknowledgments

We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`.

#### Severity
- CVSS Score: 2.3 / 10 (Low)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5)
- [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160)
- [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html)
- [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>tokio-rs/tracing (tracing-subscriber)</summary>

### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22

[Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22)

##### Important

The previous release [0.3.21] was yanked as it depended explicitly on
[tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang#8203;3424] for
details). This release contains all the changes from the previous release, plus
an update to the newer version of `tracing`.

##### Changed

- `tracing`: updated to 0.1.43 ([#&rust-lang#8203;3427])

[#&rust-lang#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424

[#&rust-lang#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427

[0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21

[tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42

### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21

[Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21)

##### Fixed

- Change registry exit to decrement local span ref only ([#&rust-lang#8203;3331])
- Make Layered propagate `on_register_dispatch` ([#&rust-lang#8203;3379])

##### Changed

- `tracing`: updated to 0.1.42 ([#&rust-lang#8203;3418])

##### Performance

- Remove `clone_span` on enter ([#&rust-lang#8203;3289])

##### Documented

- Fix a few small things in the format module ([#&rust-lang#8203;3339])
- Fix extra closing brace in layer docs ([#&rust-lang#8203;3350])
- Fix link in `FmtSpan` docs ([#&rust-lang#8203;3411])

[#&rust-lang#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289

[#&rust-lang#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331

[#&rust-lang#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339

[#&rust-lang#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350

[#&rust-lang#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379

[#&rust-lang#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411

[#&rust-lang#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…-actions, r=jieyouxu

Update actions/checkout action to v7

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5` → `v7.0.0` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v7.0.0)

- Block checking out fork PR for pull\_request\_target and workflow\_run by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2454](https://redirect.github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2458](https://redirect.github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2460](https://redirect.github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2461](https://redirect.github.com/actions/checkout/pull/2461)
- Bump [@&rust-lang#8203;actions/core](https://redirect.github.com/actions/core) and [@&rust-lang#8203;actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2459](https://redirect.github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2463](https://redirect.github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2462](https://redirect.github.com/actions/checkout/pull/2462)

### [`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3)

- Fix checkout init for SHA-256 repositories by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2439](https://redirect.github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2414](https://redirect.github.com/actions/checkout/pull/2414)

### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2)

- Fix tag handling: preserve annotations and explicit fetch-tags by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2356](https://redirect.github.com/actions/checkout/pull/2356)

### [`v6.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1)

- Add worktree support for persist-credentials includeIf by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2327](https://redirect.github.com/actions/checkout/pull/2327)

### [`v6.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6)

- Persist creds to a separate file by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2286](https://redirect.github.com/actions/checkout/pull/2286)
- Update README to include Node.js 24 support details and requirements by [@&rust-lang#8203;salmanmkc](https://redirect.github.com/salmanmkc) in [#&rust-lang#8203;2248](https://redirect.github.com/actions/checkout/pull/2248)

### [`v5.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1)

- Port v6 cleanup to v5 by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2301](https://redirect.github.com/actions/checkout/pull/2301)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…ulnerability, r=jieyouxu

Update Rust crate rand to v0.9.3 [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dependencies | patch | `0.9.2` → `0.9.3` |
| [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dev-dependencies | patch | `0.9.2` → `0.9.3` |

---

### Rand is unsound with a custom logger using rand::rng()
[GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc)

<details>
<summary>More information</summary>

#### Details
It has been reported (by @&rust-lang#8203;lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:

- The `log` and `thread_rng` features are enabled
- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
- The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
- Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed

`TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.

#### Severity
Low

#### References
- [https://github.com/rust-random/rand/pull/1763](https://redirect.github.com/rust-random/rand/pull/1763)
- [https://rustsec.org/advisories/RUSTSEC-2026-0097.html](https://rustsec.org/advisories/RUSTSEC-2026-0097.html)
- [https://github.com/advisories/GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>rust-random/rand (rand)</summary>

### [`v0.9.3`](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3)

[Compare Source](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…lnerability, r=jieyouxu

Update Rust crate tar to v0.4.46 [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [tar](https://redirect.github.com/composefs/tar-rs) | dependencies | patch | `0.4.45` → `0.4.46` |

---

### tar has a PAX header desynchronization issue
[GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2)

<details>
<summary>More information</summary>

#### Details
##### Summary

When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.

[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the "pax Header Block" section for the specific prescription there.

As a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header's `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers.

##### PoC

[This tar](https://redirect.github.com/user-attachments/files/27141941/pax-overrides-extension-header.tar.zip) (zipped for size) demonstrates the desynchronization: with `tar tvf`:

```
% tar tvf tests/archives/pax-overrides-extension-header.tar
----------  0 0      0        2048 Dec 31  1969 longname.txt
----------  0 0      0           0 Dec 31  1969 file_b
```

with `tar-rs`:

```
---- pax_size_does_not_apply_to_extension_headers stdout ----

thread 'pax_size_does_not_apply_to_extension_headers' (250476889) panicked at tests/all.rs:2121:27:
called `Result::unwrap()` on an `Err` value: Custom { kind: Other, error: "numeric field was not a number: AAAAAAAA when getting cksum for AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
```

In the above case, the PoC is not weaponized, so it jumps into the middle of an entry and subsequently fails the checksum test rather than silently continuing with attacker-controlled archive state.

##### Impact

This is very similar to GHSA-j5gw-2vrg-8fgx and GHSA-fp55-jw48-c537 in impact -- an attacker can use this to extract (or not extract) files from a tar stream depending on the tar parser used, which in turn can be used to obscure the presence of malicious files.

#### Severity
Medium

#### References
- [https://github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2)
- [https://github.com/composefs/tar-rs/pull/454](https://redirect.github.com/composefs/tar-rs/pull/454)
- [https://github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838](https://redirect.github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838)
- [https://github.com/composefs/tar-rs/releases/tag/0.4.46](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)
- [https://github.com/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>composefs/tar-rs (tar)</summary>

### [`v0.4.46`](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)

[Compare Source](https://redirect.github.com/composefs/tar-rs/compare/0.4.45...0.4.46)

#### Security

- archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;454](https://redirect.github.com/composefs/tar-rs/pull/454)

See also <GHSA-3cv2-h65g-fgmm>

#### Other changes

- ci: Fix and re-enable reverse dependency testing by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;444](https://redirect.github.com/composefs/tar-rs/pull/444)
- Update astral-tokio-tar requirement from 0.5 to 0.6 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446)
- Update some links by [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445)
- Add support of absolute paths by [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426)
- docs: Expand notes on concurrent mutations and following symlinks by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;453](https://redirect.github.com/composefs/tar-rs/pull/453)
- Update repo links by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;451](https://redirect.github.com/composefs/tar-rs/pull/451)
- ci: Add crates.io trusted publishing workflow by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;456](https://redirect.github.com/composefs/tar-rs/pull/456)
- Release 0.4.46 by [@&rust-lang#8203;cgwalters](https://redirect.github.com/cgwalters) in [#&rust-lang#8203;455](https://redirect.github.com/composefs/tar-rs/pull/455)

#### New Contributors

- [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] made their first contribution in [#&rust-lang#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446)
- [@&rust-lang#8203;atouchet](https://redirect.github.com/atouchet) made their first contribution in [#&rust-lang#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445)
- [@&rust-lang#8203;zxvfc](https://redirect.github.com/zxvfc) made their first contribution in [#&rust-lang#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426)

**Full Changelog**: <composefs/tar-rs@0.4.45...0.4.46>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…g-subscriber-vulnerability, r=jieyouxu

Update Rust crate tracing-subscriber [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` |
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` |
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` |

---

###  Tracing logging user input may result in poisoning logs with ANSI escape sequences
[CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5)

<details>
<summary>More information</summary>

#### Details
##### Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

- Manipulate terminal title bars
- Clear screens or modify terminal display
- Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

##### Patches

`tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

##### Workarounds

Avoid printing logs to terminal emulators without escaping ANSI control sequences.

##### References

https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/

##### Acknowledgments

We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`.

#### Severity
- CVSS Score: 2.3 / 10 (Low)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5)
- [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160)
- [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html)
- [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>tokio-rs/tracing (tracing-subscriber)</summary>

### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22

[Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22)

##### Important

The previous release [0.3.21] was yanked as it depended explicitly on
[tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang#8203;3424] for
details). This release contains all the changes from the previous release, plus
an update to the newer version of `tracing`.

##### Changed

- `tracing`: updated to 0.1.43 ([#&rust-lang#8203;3427])

[#&rust-lang#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424

[#&rust-lang#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427

[0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21

[tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42

### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21

[Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21)

##### Fixed

- Change registry exit to decrement local span ref only ([#&rust-lang#8203;3331])
- Make Layered propagate `on_register_dispatch` ([#&rust-lang#8203;3379])

##### Changed

- `tracing`: updated to 0.1.42 ([#&rust-lang#8203;3418])

##### Performance

- Remove `clone_span` on enter ([#&rust-lang#8203;3289])

##### Documented

- Fix a few small things in the format module ([#&rust-lang#8203;3339])
- Fix extra closing brace in layer docs ([#&rust-lang#8203;3350])
- Fix link in `FmtSpan` docs ([#&rust-lang#8203;3411])

[#&rust-lang#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289

[#&rust-lang#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331

[#&rust-lang#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339

[#&rust-lang#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350

[#&rust-lang#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379

[#&rust-lang#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411

[#&rust-lang#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 16, 2026
…-actions, r=jieyouxu

Update actions/checkout action to v7

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5` → `v7.0.0` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v7.0.0)

- Block checking out fork PR for pull\_request\_target and workflow\_run by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2454](https://redirect.github.com/actions/checkout/pull/2454)
- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2458](https://redirect.github.com/actions/checkout/pull/2458)
- Bump flatted from 3.3.1 to 3.4.2 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2460](https://redirect.github.com/actions/checkout/pull/2460)
- Bump js-yaml from 4.1.0 to 4.2.0 by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2461](https://redirect.github.com/actions/checkout/pull/2461)
- Bump [@&rust-lang#8203;actions/core](https://redirect.github.com/actions/core) and [@&rust-lang#8203;actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2459](https://redirect.github.com/actions/checkout/pull/2459)
- upgrade module to esm and update dependencies by [@&rust-lang#8203;aiqiaoy](https://redirect.github.com/aiqiaoy) in [#&rust-lang#8203;2463](https://redirect.github.com/actions/checkout/pull/2463)
- Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@&rust-lang#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&rust-lang#8203;2462](https://redirect.github.com/actions/checkout/pull/2462)

### [`v6.0.3`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.2...v6.0.3)

- Fix checkout init for SHA-256 repositories by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2439](https://redirect.github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@&rust-lang#8203;yaananth](https://redirect.github.com/yaananth) in [#&rust-lang#8203;2414](https://redirect.github.com/actions/checkout/pull/2414)

### [`v6.0.2`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.1...v6.0.2)

- Fix tag handling: preserve annotations and explicit fetch-tags by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2356](https://redirect.github.com/actions/checkout/pull/2356)

### [`v6.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v6...v6.0.1)

- Add worktree support for persist-credentials includeIf by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2327](https://redirect.github.com/actions/checkout/pull/2327)

### [`v6.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v5.0.1...v6)

- Persist creds to a separate file by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2286](https://redirect.github.com/actions/checkout/pull/2286)
- Update README to include Node.js 24 support details and requirements by [@&rust-lang#8203;salmanmkc](https://redirect.github.com/salmanmkc) in [#&rust-lang#8203;2248](https://redirect.github.com/actions/checkout/pull/2248)

### [`v5.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)

[Compare Source](https://redirect.github.com/actions/checkout/compare/v5...v5.0.1)

- Port v6 cleanup to v5 by [@&rust-lang#8203;ericsciple](https://redirect.github.com/ericsciple) in [#&rust-lang#8203;2301](https://redirect.github.com/actions/checkout/pull/2301)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
github-actions Bot pushed a commit to rust-lang/rustc-dev-guide that referenced this pull request Jul 20, 2026
…ity, r=jieyouxu

Update Rust crate rand to v0.9.3 [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dependencies | patch | `0.9.2` → `0.9.3` |
| [rand](https://rust-random.github.io/book) ([source](https://redirect.github.com/rust-random/rand)) | dev-dependencies | patch | `0.9.2` → `0.9.3` |

---

### Rand is unsound with a custom logger using rand::rng()
[GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc)

<details>
<summary>More information</summary>

#### Details
It has been reported (by @&rust-lang/rust#8203;lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:

- The `log` and `thread_rng` features are enabled
- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
- The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
- Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed

`TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.

#### Severity
Low

#### References
- [https://github.com/rust-random/rand/pull/1763](https://redirect.github.com/rust-random/rand/pull/1763)
- [https://rustsec.org/advisories/RUSTSEC-2026-0097.html](https://rustsec.org/advisories/RUSTSEC-2026-0097.html)
- [https://github.com/advisories/GHSA-cq8v-f236-94qc](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cq8v-f236-94qc) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>rust-random/rand (rand)</summary>

### [`v0.9.3`](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3)

[Compare Source](https://redirect.github.com/rust-random/rand/compare/0.9.2...0.9.3)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
github-actions Bot pushed a commit to rust-lang/rustc-dev-guide that referenced this pull request Jul 20, 2026
…ber-vulnerability, r=jieyouxu

Update Rust crate tracing-subscriber [SECURITY]

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` |
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` |
| [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` |

---

###  Tracing logging user input may result in poisoning logs with ANSI escape sequences
[CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5)

<details>
<summary>More information</summary>

#### Details
##### Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

- Manipulate terminal title bars
- Clear screens or modify terminal display
- Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

##### Patches

`tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

##### Workarounds

Avoid printing logs to terminal emulators without escaping ANSI control sequences.

##### References

https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/

##### Acknowledgments

We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`.

#### Severity
- CVSS Score: 2.3 / 10 (Low)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5)
- [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160)
- [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html)
- [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>tokio-rs/tracing (tracing-subscriber)</summary>

### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22

[Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22)

##### Important

The previous release [0.3.21] was yanked as it depended explicitly on
[tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang/rust#8203;3424] for
details). This release contains all the changes from the previous release, plus
an update to the newer version of `tracing`.

##### Changed

- `tracing`: updated to 0.1.43 ([#&rust-lang/rust#8203;3427])

[#&rust-lang/rust#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424

[#&rust-lang/rust#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427

[0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21

[tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42

### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21

[Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21)

##### Fixed

- Change registry exit to decrement local span ref only ([#&rust-lang/rust#8203;3331])
- Make Layered propagate `on_register_dispatch` ([#&rust-lang/rust#8203;3379])

##### Changed

- `tracing`: updated to 0.1.42 ([#&rust-lang/rust#8203;3418])

##### Performance

- Remove `clone_span` on enter ([#&rust-lang/rust#8203;3289])

##### Documented

- Fix a few small things in the format module ([#&rust-lang/rust#8203;3339])
- Fix extra closing brace in layer docs ([#&rust-lang/rust#8203;3350])
- Fix link in `FmtSpan` docs ([#&rust-lang/rust#8203;3411])

[#&rust-lang/rust#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289

[#&rust-lang/rust#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331

[#&rust-lang/rust#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339

[#&rust-lang/rust#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350

[#&rust-lang/rust#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379

[#&rust-lang/rust#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411

[#&rust-lang/rust#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

std::run::Process::new() should take &[&str] instead of &[~str]

7 participants