Description
Address Security Vulnerabilities and Lint Issues Identified by Trunk Check
Description
Running trunk check --all at the root of the repository revealed 12 security vulnerabilities in dependencies listed in Cargo.lock and 2 lint issues in the codebase. This issue tracks the necessary updates and refactoring to resolve these problems, prioritized by severity and impact.
Security Vulnerabilities (Cargo.lock)
The following dependencies have known vulnerabilities or maintenance issues. Proposed actions include updating to patched versions (where available) or replacing unmaintained crates.
-
High Priority:
array-init-cursor(v0.2.0)- Issues:
- Unsound when used with types implementing
Drop(GHSA-67r5-rqwv-9p9q, RUSTSEC-2025-0019).
- Unsound when used with types implementing
- Action: No patched version exists. Replace with a maintained alternative (e.g.,
arrayvecor manual array initialization). - Line: 536:0
- Issues:
-
High Priority:
openssl(v0.10.71)- Issues:
- Use-after-free in
Md::fetchandCipher::fetch(GHSA-4fcv-w3qc-ppgg, RUSTSEC-2025-0022).
- Use-after-free in
- Action: Update to
opensslv0.10.72 or later if available, or switch torustlsfor a safer alternative. - Line: 2774:0
- Issues:
-
High Priority:
paste(v1.0.15)- Issue: No longer maintained (RUSTSEC-2024-0436).
- Action: Replace with an actively maintained crate like
quoteorsynfor code generation needs. - Line: 2884:0
-
High Priority:
pyo3(v0.23.5)- Issues:
- Buffer overflow risk in
PyString::from_object(GHSA-pph8-gcv7-4qj5, RUSTSEC-2025-0020).
- Buffer overflow risk in
- Action: Update to
pyo3v0.23.6 or later if patched, or review usage to mitigate risk. - Line: 3561:0
- Issues:
-
High Priority:
ring(v0.17.11)- Issues:
- AES functions may panic with overflow checking enabled (RUSTSEC-2025-0009).
- Action: Update to
ringv0.17.12 or later if patched, or switch toaescrate from Rust Crypto. - Line: 4056:0
- Issues:
-
High Priority:
tokio(v1.43.0)- Issues:
- Broadcast channel calls
clonein parallel without requiringSync(GHSA-rr8g-9fpq-6wmg, RUSTSEC-2025-0023).
- Broadcast channel calls
- Action: Update to
tokiov1.44.0 or later if patched, or enforceSyncbounds manually. - Line: 5105:0
- Issues:
-
High Priority:
derivative(v2.2.0)- Issue: Unmaintained (RUSTSEC-2024-0388).
- Action: Replace with
derive_moreor another maintained derive crate. - Line: 1279:0
-
Medium Priority:
ring(v0.17.11)- Issue:
- Additional note on AES panic issue (GHSA-4p46-pwfr-66x6).
- Action: Same as above (update or replace).
- Line: 4056:0
- Issue:
-
Medium Priority:
rust-openssl(v0.10.71)- Issue:
- Use-after-free overlap with
openssl(GHSA-4fcv-w3qc-ppgg).
- Use-after-free overlap with
- Action: Same as
opensslabove. - Line: 2774:0
- Issue:
-
Low Priority:
pyo3(v0.23.5)- Issue:
- Lower-severity note on buffer overflow (GHSA-pph8-gcv7-4qj5).
- Action: Same as above (update or review).
- Line: 3561:0
- Issue:
-
Low Priority:
tokio(v1.43.0)- Issue:
- Lower-severity note on broadcast channel (GHSA-rr8g-9fpq-6wmg).
- Action: Same as above (update or enforce bounds).
- Line: 5105:0
- Issue:
-
Low Priority:
array-init-cursor(v0.2.0)- Issue:
- Lower-severity note on unsoundness (GHSA-67r5-rqwv-9p9q).
- Action: Same as above (replace).
- Line: 536:0
- Issue:
Lint Issues (Codebase)
The following functions exceed the recommended number of arguments per Clippy’s too_many_arguments rule (max 7).
-
Medium Priority:
crates/cairo-addons/src/vm/pythonic_hint.rs:175:5- Issue: Function has 8 arguments.
- Action: Refactor to use a struct or builder pattern to group related arguments.
- Line: 175:5
-
Medium Priority:
crates/cairo-addons/src/vm/runner.rs:74:5- Issue: Function has 9 arguments.
- Action: Refactor to use a struct or builder pattern to group related arguments.
- Line: 74:5
Steps to Resolve
- Dependency Updates: Run
cargo updateand manually adjust versions inCargo.tomlwhere necessary. Replace unmaintained crates with alternatives. - Code Refactoring: Address lint issues by refactoring functions with excessive arguments.
- Verification: Re-run
trunk check --allto confirm all issues are resolved.
Priority Rationale
- High: Critical security vulnerabilities (e.g., use-after-free, buffer overflows) or unmaintained crates that require immediate replacement.
- Medium: Non-critical security issues or code quality improvements that should be addressed soon.
- Low: Lower-severity duplicates of higher-priority issues, less urgent but still actionable.
Additional Notes
- Assign this issue to the appropriate team member(s).
- Consider automating dependency updates with a tool like Dependabot to prevent future vulnerabilities.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status