cargo-geiger 0.14.0

15 vulnerabilities

processes: 696
operations: 208K
packages: 430
compiler runs: 1,803
connections: 1
job time: 5m 27s
capture: 1.3 MB
records: 290K
bytes / record: 4.6

run 8118e0b1-bcb6-4b52-a1e2-9a4123d6a03a · built 2026-10-12 · complete Release

Artifact

binary · retained · product · graph v2

Checks	Detections
Build behavior
✓ Network activity	—
✓ Sensitive data access and transfer	—
✓ Cross-process access	—
✓ Build file changes	—
✓ Build script activity	—
✓ Data flow analysis	—
✓ Filesystem writes	—
✓ Context collection	—
Supply chain
▲ Known vulnerabilities	—
✓ Build-time dependency advisories	—
▲ Dependency advisories	—
✓ Declared and observed dependencies	—
✓ Dependency and toolchain versions	—
Pipeline
✓ Pipeline coverage	—

Detections

No detections

No abnormal activity detected across 208K flows.

Network

0 peers

cargo fetched 25,615 files from static.crates.io

Vulnerable dependencies15	Package	Version	Fix	Severity	Title	Reach
CVE-2026-40034	gix	0.79.0	>=0.83.0	high	gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules	retained
GHSA-fr8x-3vfx-f45h	gix	0.79.0	>=0.83.0	high	gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository	retained
GHSA-p3hw-mv63-rf9w	gix	0.79.0	>=0.83.0	high	gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure	retained
GHSA-pg4w-g64p-qwhj	gix	0.79.0	>=0.83.0	high	gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository	retained
CVE-2026-44471	gix-fs	0.19.2	>=0.21.1	high	gix-fs: Symlink prefix-reuse allows worktree escape during checkout	retained
GHSA-x494-mj8g-cj27	gix-pack	0.66.0	>=0.69.0	high	gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data	retained
CVE-2026-5223	cargo	0.96.0	>=0.97.0	medium	Cargo crates in third party registries can override the cached source of other crates	retained
GHSA-9857-6mw7-fq2m	gix-transport	0.54.0	>=0.56.0	medium	gix-transport: HTTP credentials leaked to redirected host in curl backend	retained
RUSTSEC-2026-0247	bitmaps	2.1.0	none published	low	bitmaps is unmaintained	retained
CVE-2026-5222	cargo	0.96.0	>=0.97.0	low	Cargo can be coerced to share credentials between registries	retained
RUSTSEC-2026-0183	git2	0.20.4	>=0.21.0	low	Potential undefined behavior when calling Remote::list()	retained
RUSTSEC-2026-0184	git2	0.20.4	>=0.21.0	low	Potential undefined behavior with Signature from a buffer-created BlameHunk	retained
RUSTSEC-2026-0250	im-rc	15.1.0	none published	low	im-rc is unmaintained	retained
RUSTSEC-2026-0251	sized-chunks	0.6.5	none published	low	sized-chunks is unmaintained	retained
RUSTSEC-2026-0255	sized-chunks	0.6.5	none published	low	Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)	retained

Dependencies

455 packages, 46 with a build script that ran, 12 doing more than compiling

Package	Version	Usage	Build behaviour
curl-sys	0.4.83+curl-8.15.0	linked	build scriptruns tools git
libssh2-sys	0.3.3	linked	build scriptruns tools git
vcpkg	0.2.15	linked	prebuilt objects
windows_aarch64_gnullvm	0.52.6	platform_gated	build script, not runprebuilt objects
windows_aarch64_msvc	0.52.6	platform_gated	build script, not runprebuilt objects
windows_i686_gnu	0.52.6	platform_gated	build script, not runprebuilt objects
windows_i686_gnullvm	0.52.6	platform_gated	build script, not runprebuilt objects
windows_i686_msvc	0.52.6	platform_gated	build script, not runprebuilt objects
windows_x86_64_gnu	0.52.6	platform_gated	build script, not runprebuilt objects
windows_x86_64_gnullvm	0.52.6	platform_gated	build script, not runprebuilt objects
windows_x86_64_msvc	0.52.6	platform_gated	build script, not runprebuilt objects
wit-bindgen	0.57.1	platform_gated	build script, not runprebuilt objects
anyhow direct	1.0.104	linked	build script
assert_cmd	2.2.2	unrelated	build script
blake3	1.8.7	linked	build script
camino	1.2.6	linked	build script
cargo direct	0.96.0	linked	build script
color-print-proc-macro	0.3.7	linked	proc macro
crc32fast	1.5.2	linked	build script
crossbeam-deque	0.8.8	linked	build script
crossbeam-epoch	0.9.21	linked	build script
crossbeam-utils	0.8.23	linked	build script
curl	0.4.49	linked	build script
defmt	1.1.1	feature_gated	build script, not run
defmt-macros	1.1.1	buildtime_only	build script, not runproc macro
displaydoc	0.2.7	linked	proc macro
encoding_rs	0.8.42	linked	build script
erased-serde	0.4.10	linked	build script
faster-hex	0.10.1	linked	build script
futures-macro	0.3.34	linked_undeclared	proc macro
generic-array	0.14.9	linked	build script
getrandom	0.3.4	linked	build script
getrandom	0.4.3	linked	build script
icu_normalizer_data	2.3.0	linked	build script
icu_properties_data	2.3.0	linked	build script
im-rc	15.1.0	linked	build script
jiff-static	0.2.38	buildtime_only	proc macro
ld-linux-x86-64.so.2		linked	system library
libc	0.2.190	linked	build script
libc.so.6		linked	system library
libcrypto.so.3		linked	system library
libgcc_s.so.1		linked	system library
libgit2-sys	0.18.8+1.9.7	linked	build script
libm.so.6		linked	system library
libmvec.so.1		linked	system library
libnghttp2-sys	0.1.13+1.68.1	linked	build script
libsqlite3-sys	0.36.0	linked	build script
libssl.so.3		linked	system library
libz-sys	1.1.29	linked	build script
maybe-async	0.2.11	linked	proc macro
multiversion_no_op	1.0.0	linked	proc macro
num-traits	0.2.19	linked	build script
objc2	0.6.5	platform_gated	build script, not run
object	0.37.3	unrelated	build script
openssl-sys	0.9.117	linked	build script
parking_lot_core	0.9.12	linked	build script
portable-atomic	1.15.0	linked	build script
portable-atomic-util	0.2.8	platform_gated	build script, not run
proc-macro2	1.0.107	linked	build script
quote	1.0.47	linked	build script
rayon-core	1.13.0	linked	build script
rstest_macros	0.18.2	linked_undeclared	build scriptproc macro
rustix	1.1.5	linked	build script
rustversion	1.0.23	linked	build scriptproc macro
serde direct	1.0.229	linked	build script
serde_core	1.0.229	linked	build script
serde_derive	1.0.229	linked	proc macro
serde_json direct	1.0.154	linked	build script
sqlite-wasm-rs	0.5.5	platform_gated	build script, not run
strum_macros direct	0.28.0	linked	proc macro
thiserror	2.0.21	linked	build script
thiserror-impl	2.0.21	linked	proc macro
time-macros	0.2.32	buildtime_only	proc macro
tracing-attributes	0.1.31	linked	proc macro
typeid	1.0.3	linked	build script
valuable	0.1.1	feature_gated	build script, not run
wasm-bindgen	0.2.129	platform_gated	build script, not run
wasm-bindgen-macro	0.2.129	buildtime_only	proc macro
wasm-bindgen-shared	0.2.129	platform_gated	build script, not run
yoke-derive	0.8.4	linked	proc macro
zerocopy	0.8.62	linked	build script
zerocopy-derive	0.8.62	buildtime_only	proc macro
zerofrom-derive	0.1.8	linked	proc macro
zerovec-derive	0.11.6	linked	proc macro
zmij	1.0.23	linked	build script
addr2line	0.25.1	unrelated
adler2	2.0.1	unrelated
aho-corasick	1.1.5	linked
allocator-api2	0.2.21	linked
android_system_properties	0.1.6	platform_gated
annotate-snippets	0.12.16	linked
anstream	0.6.21	linked
anstream	1.0.0	linked
anstyle	1.0.14	linked
anstyle-parse	0.2.7	linked
anstyle-parse	1.0.0	linked
anstyle-query	1.1.5	linked
anstyle-wincon	3.0.11	platform_gated
arc-swap	1.9.2	linked
arrayvec	0.7.8	linked
autocfg	1.5.1	buildtime_only
backtrace	0.3.76	unrelated
base16ct	0.2.0	linked
base64	0.22.1	linked
base64ct	1.8.3	linked
better-panic	0.3.0	unrelated
bitflags	1.3.2	feature_gated
bitflags	2.13.2	linked
bitmaps	2.1.0	linked
block-buffer	0.10.4	linked
block-buffer	0.12.1	linked
block2	0.6.2	platform_gated
bstr	1.13.1	linked
bumpalo	3.20.3	buildtime_only
bytes	1.12.1	linked
cargo-credential	0.4.11	linked
cargo-credential-libsecret	0.5.10	linked
cargo-credential-macos-keychain	0.4.25	platform_gated
cargo-credential-wincred	0.4.25	platform_gated
cargo-geiger-serde direct	0.3.0	linked
cargo-platform direct	0.1.9	linked
cargo-platform	0.3.3	linked
cargo-util direct	0.2.32	linked
cargo-util-schemas	0.13.0	linked
cargo_metadata	0.19.2	linked
cc	1.8.0	linked
cfg-expr	0.18.0	linked
cfg-if	1.0.5	linked
cfg_aliases	0.2.2	buildtime_only
chacha20	0.10.2	linked_undeclared
clap	4.6.7	linked
clap_builder	4.6.7	linked
clap_complete	4.6.11	linked
clap_lex	1.1.1	linked
clru	0.6.3	linked
color-print	0.3.7	linked
colorchoice	1.0.5	linked
colored direct	3.1.1	linked
console direct	0.15.11	linked
console	0.16.6	unrelated
const-oid	0.10.2	linked
const-oid	0.9.6	linked
constant_time_eq	0.4.2	linked
core-foundation	0.10.1	platform_gated
core-foundation-sys	0.8.7	platform_gated
core_detect	1.0.0	linked
cpufeatures	0.2.17	linked
cpufeatures	0.3.1	linked
crates-io	0.40.19	linked
crossbeam-channel	0.5.17	linked
crypto-bigint	0.5.5	linked
crypto-common	0.1.6	linked
crypto-common	0.2.2	linked
ct-codecs	1.1.8	linked
dashmap	6.2.1	linked
defmt	0.3.100	feature_gated
defmt-parser	1.0.0	buildtime_only
der	0.7.10	linked
deranged	0.5.8	linked
difflib	0.4.0	unrelated
digest	0.10.7	linked
digest	0.11.3	linked
dispatch2	0.3.1	feature_gated
dunce	1.0.5	platform_gated
ecdsa	0.16.9	linked
ed25519-compact	2.6.0	linked
either	1.19.0	linked
elliptic-curve	0.13.8	linked
encode_unicode	1.0.0	platform_gated
equivalent	1.0.2	linked
errno	0.3.14	platform_gated
fallible-iterator	0.3.0	linked
fallible-streaming-iterator	0.1.9	linked
fastrand	2.5.0	linked
ff	0.13.1	linked
fiat-crypto	0.3.0	linked
filetime	0.2.29	linked
find-msvc-tools	0.1.14	linked
fixedbitset	0.5.7	linked
flate2	1.1.10	linked
fnv	1.0.7	linked
foldhash	0.1.5	linked
foldhash	0.2.0	linked
form_urlencoded	1.2.2	linked
fs_extra	1.3.0	unrelated
futures	0.3.34	linked_undeclared
futures-channel	0.3.34	linked_undeclared
futures-core	0.3.34	linked_undeclared
futures-executor	0.3.34	linked_undeclared
futures-io	0.3.34	linked_undeclared
futures-sink	0.3.34	linked_undeclared
futures-task	0.3.34	linked_undeclared
futures-timer	3.0.4	linked_undeclared
futures-util	0.3.34	linked_undeclared
geiger direct	0.5.0	linked
getrandom	0.2.17	linked
gimli	0.32.3	unrelated
git2	0.20.4	linked
gix	0.79.0	linked
gix-actor	0.39.0	linked
gix-attributes	0.30.1	linked
gix-bitmap	0.2.16	linked
gix-chunk	0.6.0	linked
gix-command	0.7.1	linked
gix-commitgraph	0.33.0	linked
gix-config	0.52.0	linked
gix-config-value	0.17.2	linked
gix-credentials	0.36.0	linked
gix-date	0.14.0	linked
gix-diff	0.59.0	linked
gix-dir	0.21.0	linked
gix-discover	0.47.0	linked
gix-error	0.1.0	linked
gix-features	0.46.2	linked
gix-filter	0.26.0	linked
gix-fs	0.19.2	linked
gix-glob	0.24.0	linked
gix-hash	0.22.1	linked
gix-hashtable	0.12.0	linked
gix-ignore	0.19.1	linked
gix-index	0.47.0	linked
gix-lock	21.0.2	linked
gix-negotiate	0.27.0	linked
gix-object	0.56.0	linked
gix-odb	0.76.0	linked
gix-pack	0.66.0	linked
gix-packetline	0.21.5	linked
gix-path	0.11.3	linked
gix-pathspec	0.15.1	linked
gix-prompt	0.13.1	linked
gix-protocol	0.57.0	linked
gix-quote	0.6.2	linked
gix-ref	0.59.0	linked
gix-refspec	0.37.0	linked
gix-revision	0.41.0	linked
gix-revwalk	0.27.0	linked
gix-sec	0.13.3	linked
gix-shallow	0.8.1	linked
gix-status	0.26.0	linked
gix-submodule	0.26.0	linked
gix-tempfile	21.0.2	linked
gix-trace	0.1.21	linked
gix-transport	0.54.0	linked
gix-traverse	0.53.0	linked
gix-url	0.35.3	linked
gix-utils	0.3.6	linked
gix-validate	0.11.4	linked
gix-worktree	0.48.0	linked
glob	0.3.4	linked
globset	0.4.20	linked
group	0.13.0	linked
hashbrown	0.14.5	linked
hashbrown	0.15.5	linked
hashbrown	0.16.1	linked
hashbrown	0.17.1	linked
hashlink	0.11.1	linked
heck	0.5.0	linked
hex	0.4.3	linked
hkdf	0.12.4	linked
hmac	0.12.1	linked
home	0.5.12	linked
http-auth	0.1.10	linked
hybrid-array	0.4.15	linked
icu_collections	2.3.0	linked
icu_locale_core	2.3.0	linked
icu_normalizer	2.3.0	linked
icu_properties	2.3.0	linked
icu_provider	2.3.1	linked
idna	1.1.0	linked
idna_adapter	1.2.2	linked
ignore	0.4.33	linked
imara-diff	0.1.8	linked
indexmap	2.14.2	linked
insta	1.49.0	unrelated
is_executable	1.0.6	linked
is_terminal_polyfill	1.70.2	linked
itertools	0.14.0	linked
itoa	1.0.18	linked
jiff	0.2.38	linked
jiff-core	0.1.1	linked
jiff-tzdb	0.1.9	platform_gated
jiff-tzdb-platform	0.1.3	platform_gated
jobserver	0.1.35	linked
js-sys	0.3.106	platform_gated
krates direct	0.18.1	linked
kstring	2.0.5	linked
libloading	0.9.0	linked
linux-raw-sys	0.12.1	linked
litemap	0.8.3	linked
lock_api	0.4.14	linked
log	0.4.34	linked
memchr	2.8.3	linked
memmap2	0.9.11	linked
minimal-lexical	0.2.1	buildtime_only
miniz_oxide	0.8.9	unrelated
miow	0.6.1	platform_gated
nom	7.1.3	linked
normpath	1.5.2	platform_gated
num-conv	0.2.2	linked
objc2-cloud-kit	0.3.2	platform_gated
objc2-core-data	0.3.2	platform_gated
objc2-core-foundation	0.3.2	platform_gated
objc2-core-graphics	0.3.2	platform_gated
objc2-core-image	0.3.2	platform_gated
objc2-core-location	0.3.2	platform_gated
objc2-core-text	0.3.2	platform_gated
objc2-encode	4.1.0	platform_gated
objc2-foundation	0.3.2	platform_gated
objc2-io-surface	0.3.2	feature_gated
objc2-quartz-core	0.3.2	platform_gated
objc2-ui-kit	0.3.2	platform_gated
objc2-user-notifications	0.3.2	platform_gated
once_cell	1.21.4	linked
once_cell_polyfill	1.70.2	platform_gated
opener	0.8.5	linked
openssl-probe	0.1.6	linked
ordered-float	2.10.1	linked
orion	0.17.15	linked
p384	0.13.1	linked
parking_lot	0.12.5	linked
pasetors	0.7.8	linked
pathdiff	0.2.3	linked
pem-rfc7468	0.7.0	linked
percent-encoding	2.3.2	linked
petgraph direct	0.7.1	linked
pico-args direct	0.5.0	linked
pin-project-lite	0.2.17	linked
pkcs8	0.10.2	linked
pkg-config	0.3.34	linked
potential_utf	0.1.6	linked
powerfmt	0.2.1	linked
ppv-lite86	0.2.21	linked
predicates	3.1.4	unrelated
predicates-core	1.0.10	unrelated
predicates-tree	1.0.13	unrelated
primeorder	0.13.6	linked
prodash	31.0.1	linked
rand	0.10.3	linked_undeclared
rand	0.9.5	linked
rand_chacha	0.9.0	linked
rand_core	0.10.1	linked
rand_core	0.6.4	linked
rand_core	0.9.5	linked
rand_xoshiro	0.6.0	linked
rayon direct	1.12.0	linked
redox_syscall	0.5.18	platform_gated
regex direct	1.13.1	linked
regex-automata	0.4.18	linked
regex-syntax	0.8.11	linked
relative-path	1.9.3	linked_undeclared
rfc6979	0.4.0	linked
rsqlite-vfs	0.1.1	platform_gated
rstest	0.18.2	linked_undeclared
rusqlite	0.38.0	linked
rustc-demangle	0.1.28	unrelated
rustc-hash	2.1.3	linked
rustc-stable-hash	0.1.2	linked
rustc_version	0.4.1	unrelated
rustfix	0.9.8	linked
same-file	1.0.6	linked
schannel	0.1.29	platform_gated
scopeguard	1.2.0	linked
sec1	0.7.3	linked
security-framework	3.7.0	platform_gated
security-framework-sys	2.17.0	platform_gated
semver	1.0.28	linked
serde-untagged	0.1.9	linked
serde-value	0.7.0	linked
serde_ignored	0.1.14	linked
serde_spanned	1.1.2	linked
sha1	0.10.7	linked
sha1-checked	0.10.0	linked
sha2	0.10.9	linked
sha2	0.11.0	linked
shell-escape	0.1.5	linked
shell-words	1.1.1	linked
shlex	2.0.1	linked
signature	2.2.0	linked
simdutf8	0.1.5	linked
similar	2.7.0	unrelated
sized-chunks	0.6.5	linked
slab	0.4.12	linked_undeclared
smallvec	1.16.3	linked
socket2	0.6.5	linked
spki	0.7.3	linked
stable_deref_trait	1.2.1	linked
static_assertions	1.1.0	linked
strsim	0.11.1	linked
strum direct	0.28.0	linked
subtle	2.6.1	linked
supports-hyperlinks	3.2.0	linked
supports-unicode	3.0.0	linked
syn	2.0.119	linked
syn	3.0.8	linked
synstructure	0.14.0	linked
tar	0.4.46	linked
tempfile	3.27.0	linked
terminal_size	0.4.4	linked
termtree	0.5.1	unrelated
time	0.3.55	linked
time-core	0.1.9	linked
tinystr	0.8.4	linked
tinyvec	1.13.3	linked
toml	0.9.12+spec-1.1.0	linked
toml_datetime	0.7.5+spec-1.1.0	linked
toml_edit	0.24.1+spec-1.1.0	linked
toml_parser	1.1.5+spec-1.1.0	linked
toml_writer	1.1.3+spec-1.1.0	linked
tracing	0.1.44	linked
tracing-core	0.1.36	linked
typenum	1.20.1	linked
unicase	2.10.0	linked
unicode-bom	2.0.3	linked
unicode-ident	1.0.27	linked
unicode-normalization	0.1.25	linked
unicode-width	0.2.2	linked
url direct	2.5.8	linked
utf8_iter	1.0.4	linked
utf8parse	0.2.2	linked
version_check	0.9.5	buildtime_only
wait-timeout	0.2.1	unrelated
walkdir direct	2.5.0	linked
wasi	0.11.1+wasi-snapshot-preview1	platform_gated
wasip2	1.0.4+wasi-0.2.12	platform_gated
wasm-bindgen-macro-support	0.2.129	buildtime_only
winapi-util	0.1.11	platform_gated
windows-link	0.2.1	platform_gated
windows-targets	0.52.6	platform_gated
winnow	0.7.15	linked
winnow	1.0.4	linked
writeable	0.6.4	linked
yoke	0.8.3	linked
zerofrom	0.1.8	linked
zeroize	1.9.1	linked
zerotrie	0.2.5	linked
zerovec	0.11.8	linked
zlib-rs	0.6.8	linked
heapless	0.8.0	dead	build script
nix	0.31.3	dead	build script
byteorder	1.5.0	dead
git2-curl	0.21.0	dead
hash32	0.3.1	dead
lazy_static	1.5.1	dead
matchers	0.2.0	dead
nu-ansi-term	0.50.3	dead
os_info	3.15.0	dead
r-efi	5.3.0	unverified
r-efi	6.0.0	unverified
sharded-slab	0.1.7	dead
thread_local	1.1.10	dead
tracing-chrome	0.7.2	dead
tracing-log	0.2.0	dead
tracing-subscriber	0.3.23	dead
windows-sys	0.59.0	unverified
windows-sys	0.61.2	unverified

1 of 1 jobs captured: build-test success · Generated 2026-10-12 · run 8118e0b1-bcb6-4b52-a1e2-9a4123d6a03a

analysis 0.1.0 · 2026-10-11 · d6246d3 · graph v2