finetype-cli 0.6.62

1 detection18 vulnerabilities

processes: 596
operations: 149K
packages: 398
compiler runs: 1,956
connections: 3
job time: 5m 34s
capture: 1.5 MB
records: 243K
bytes / record: 6.1

Build behaviourits build script reached huggingface.co, us.aws.cdn.hf.coundeclared fetch fetch went into the output fetched outside crates.io compiled C/C++

run 361684e6-7862-494e-8de6-b78d7ff0ba26 · built 2026-10-13 · complete Release

Artifact

file · retained · product · graph v2

Checks	Detections
Build behavior
▲ Network activity	—
✓ Sensitive data access and transfer	—
✓ Cross-process access	—
✓ Build file changes	—
✓ Build script activity	—
✓ Data flow analysis	—
✓ Filesystem writes	—
✓ Context collection	—
Supply chain
▲ Known vulnerabilities	—
▲ Build-time dependency advisories	—
▲ Dependency advisories	—
✓ Declared and observed dependencies	—
✓ Dependency and toolchain versions	—
Pipeline
✓ Pipeline coverage	—

Detections

Build code opened a network connection

finetype-cli 0.6.62 › huggingface.co:443, us.aws.cdn.hf.co:443

connection to huggingface.co:443, opened by build-script-build

high

Network

2 fetches

huggingface.co

finetype-cli's own build code · build-script-build · 8 files · went into an output

undeclared
us.aws.cdn.hf.co

finetype-cli's own build code · build-script-build · 8 files · went into an output

undeclared

cargo fetched 31,538 files from static.crates.io

Vulnerable dependencies17	Package	Version	Fix	Severity	Title	Reach
RUSTSEC-2026-0204	crossbeam-epoch	0.9.18	>=0.9.20	high	Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid	retained
RUSTSEC-2026-0258	h2	0.4.13	>=0.4.16	high	h2 unbounded empty DATA frames	retained
CVE-2026-42559	rmcp	1.2.0	>=1.4.0	high	rmcp Streamable HTTP server transport has a DNS rebinding vulnerability	retained
CVE-2026-63127	rmcp	1.2.0	>=2.0.0	high	RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery	retained
CVE-2026-63128	rmcp	1.2.0	>=2.0.0	high	RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service	retained
CVE-2026-93599	rustls-webpki	0.103.9	>=0.103.13	high	rustls-webpki: Denial of service via panic on malformed CRL BIT STRING	retained
CVE-2026-64684	rmcp	1.2.0	>=2.1.0	medium	RMCP: Custom HTTP headers leak to cross-origin redirect targets	retained
GHSA-c9xm-49cp-xcr9	rmcp	1.2.0	>=2.0.0	medium	rmcp OAuth client fetches server-controlled resource_metadata URLs	retained
GHSA-2mjx-qc3c-rqvc	rustls	0.23.37	>=0.23.45	medium	Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries	retained
CVE-2026-93602	rustls-webpki	0.103.9	>=0.103.10	medium	webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic	retained
RUSTSEC-2026-0190	anyhow	1.0.102	>=1.0.103	low	Unsoundness in `Error::downcast_mut()`	retained
RUSTSEC-2026-0186	memmap2	0.9.10	>=0.9.11	low	Unchecked pointer offset in crate `memmap2`	retained
RUSTSEC-2025-0119	number_prefix	0.4.0	none published	low	number_prefix crate is unmaintained	retained
GHSA-cq8v-f236-94qc	rand	0.8.5, 0.9.2	>=0.8.6	low	Rand is unsound with a custom logger using rand::rng()	retained
CVE-2026-93600	rustls-webpki	0.103.9	>=0.103.12	low	webpki: Name constraints for URI names were incorrectly accepted	retained
CVE-2026-93601	rustls-webpki	0.103.9	>=0.103.12	low	webpki: Name constraints were accepted for certificates asserting a wildcard name	retained
RUSTSEC-2024-0449	unsafe-libyaml	0.2.11	none published	low	unsafe-libyaml is unmaintained	retained

Dependencies

453 packages, 42 with a build script that ran, 28 doing more than compiling

Package	Version	Usage	Build behaviour
aws-lc-sys	0.39.0	linked	build scriptprebuilt objects
ring	0.17.14	linked	build scriptprebuilt objects
winapi-i686-pc-windows-gnu	0.4.0	platform_gated	build script, not runprebuilt objects
winapi-x86_64-pc-windows-gnu	0.4.0	platform_gated	build script, not runprebuilt objects
wit-bindgen	0.51.0	platform_gated	build script, not runprebuilt objects
ahash	0.8.12	linked	build script
anyhow direct	1.0.102	linked	build script
async-trait	0.1.89	buildtime_only	proc macro
atomic-polyfill	1.0.3	platform_gated	build script, not run
aws-lc-rs	1.16.2	linked	build script
bytemuck_derive	1.10.2	linked	proc macro
clap_derive	4.6.0	linked	proc macro
crc32fast	1.5.0	linked	build script
crossbeam-utils	0.8.21	linked	build script
crunchy	0.2.4	platform_gated	build script, not run
darling_macro	0.20.11	linked	proc macro
darling_macro	0.23.0	linked	proc macro
derive_arbitrary	1.4.2	buildtime_only	proc macro
derive_builder_macro	0.20.2	linked	proc macro
displaydoc	0.2.5	linked	proc macro
dyn-stack-macros	0.1.3	linked	proc macro
enum-as-inner	0.6.1	buildtime_only	proc macro
esaxx-rs	0.1.10	linked	build script
futures-macro	0.3.32	linked	proc macro
generic-array	0.14.7	linked	build script
getrandom	0.3.4	linked	build script
getrandom	0.4.2	linked	build script
heapless	0.7.17	unknown	build script
httparse	1.10.1	linked	build script
iana-time-zone-haiku	0.1.2	platform_gated	build script, not run
icu_normalizer_data	2.1.1	linked	build script
icu_properties_data	2.1.2	linked	build script
ld-linux-x86-64.so.2		linked	system library
libc	0.2.183	linked	build script
libc.so.6		linked	system library
libgcc_s.so.1		linked	system library
libm.so.6		linked	system library
libmvec.so.1		linked	system library
macro_rules_attribute-proc_macro	0.2.2	linked	proc macro
monostate-impl	0.1.18	linked	proc macro
num-traits	0.2.19	linked	build script
num_enum_derive	0.7.6	linked	proc macro
onig_sys	69.9.1	linked	build script
parking_lot_core	0.9.12	linked	build script
paste	1.0.15	linked	build scriptproc macro
pastey	0.2.1	linked	proc macro
portable-atomic	1.13.1	linked	build script
prettyplease	0.2.37	buildtime_only	build script, not run
proc-macro2	1.0.106	linked	build script
pulp	0.21.5	linked	build script
quote	1.0.45	linked	build script
rayon-core	1.13.0	linked	build script
ref-cast	1.0.25	linked	build script
ref-cast-impl	1.0.25	linked	proc macro
rmcp	1.2.0	linked	build script
rmcp-macros	1.2.0	linked	proc macro
rustix	1.1.4	linked	build script
rustls	0.23.37	linked	build script
rustversion	1.0.22	linked	build scriptproc macro
schemars_derive	1.2.1	linked	proc macro
seq-macro	0.3.6	linked	proc macro
serde direct	1.0.228	linked	build script
serde_core	1.0.228	linked	build script
serde_derive	1.0.228	linked	proc macro
serde_json direct	1.0.149	linked	build script
strum_macros	0.27.2	buildtime_only	proc macro
thiserror	1.0.69	linked	build script
thiserror	2.0.18	linked	build script
thiserror-impl	1.0.69	linked	proc macro
thiserror-impl	2.0.18	linked	proc macro
tokio-macros	2.6.1	linked	proc macro
tracing-attributes	0.1.31	linked	proc macro
typenum	1.19.0	linked	build script
unicode-general-category	1.1.0	linked	build script
valuable	0.1.1	feature_gated	build script, not run
wasm-bindgen	0.2.114	platform_gated	build script, not run
wasm-bindgen-macro	0.2.114	buildtime_only	proc macro
wasm-bindgen-shared	0.2.114	platform_gated	build script, not run
winapi	0.3.9	platform_gated	build script, not run
windows-implement	0.60.2	buildtime_only	proc macro
windows-interface	0.59.3	buildtime_only	proc macro
wit-bindgen-rust	0.51.0	buildtime_only	build script, not run
wit-bindgen-rust-macro	0.51.0	buildtime_only	build script, not runproc macro
yoke-derive	0.7.5	linked	proc macro
yoke-derive	0.8.1	linked	proc macro
zerocopy	0.8.47	linked	build script
zerocopy-derive	0.8.47	linked	proc macro
zerofrom-derive	0.1.6	linked	proc macro
zerovec-derive	0.11.2	linked	proc macro
zip	1.1.4	linked	build script
zmij	1.0.21	linked	build script
aho-corasick	1.1.4	linked
allocator-api2	0.2.21	linked
android_system_properties	0.1.5	platform_gated
anstream	1.0.0	linked
anstyle	1.0.14	linked
anstyle-parse	1.0.0	linked
anstyle-query	1.1.5	linked
anstyle-wincon	3.0.11	platform_gated
arbitrary	1.4.2	platform_gated
atomic-waker	1.1.2	linked
autocfg	1.5.0	buildtime_only
base64	0.13.1	linked
base64	0.22.1	linked
bit-set	0.8.0	linked
bit-vec	0.8.0	linked
bitflags	1.3.2	linked
bitflags	2.11.0	linked
block-buffer	0.10.4	linked
borrow-or-share	0.2.4	linked
bumpalo	3.20.2	buildtime_only
bytecount	0.6.9	linked
bytemuck	1.25.0	linked
byteorder	1.5.0	linked
bytes	1.11.1	linked
candle-core	0.8.4	linked
candle-nn	0.8.4	linked
castaway	0.2.4	linked
cc	1.2.57	linked
cesu8	1.1.0	platform_gated
cfg-if	1.0.4	linked
chrono	0.4.44	linked
clap direct	4.6.0	linked
clap_builder	4.6.0	linked
clap_lex	1.1.0	linked
cmake	0.1.57	linked
cobs	0.3.0	unknown
colorchoice	1.0.5	linked
combine	4.6.7	platform_gated
compact_str	0.9.0	linked
console	0.15.11	linked
core-foundation	0.10.1	platform_gated
core-foundation-sys	0.8.7	platform_gated
cpufeatures	0.2.17	linked
critical-section	1.2.0	platform_gated
crossbeam-deque	0.8.6	linked
crossbeam-epoch	0.9.18	linked
crypto-common	0.1.7	linked
csv direct	1.4.0	linked
csv-core	0.1.13	linked
darling	0.20.11	linked
darling	0.23.0	linked
darling_core	0.20.11	linked
darling_core	0.23.0	linked
dary_heap	0.3.8	linked
data-encoding	2.10.0	linked
derive_builder	0.20.2	linked
derive_builder_core	0.20.2	linked
digest	0.10.7	linked
dirs	6.0.0	linked
dirs-sys	0.5.0	linked
dunce	1.0.5	linked
dyn-clone	1.0.20	linked
dyn-stack	0.10.0	linked
dyn-stack	0.13.2	linked
either	1.15.0	linked
email_address	0.2.9	linked
embedded-io	0.4.0	feature_gated
embedded-io	0.6.1	feature_gated
encode_unicode	1.0.0	platform_gated
equivalent	1.0.2	linked
errno	0.3.14	linked
fancy-regex	0.17.0	linked
fastrand	2.3.0	linked
find-msvc-tools	0.1.9	linked
finetype-core direct	0.6.62	linked
finetype-mcp direct	0.6.62	linked
finetype-model direct	0.6.62	linked
flate2	1.1.9	linked
fluent-uri	0.4.1	linked
fnv	1.0.7	linked
foldhash	0.1.5	buildtime_only
foldhash	0.2.0	linked
form_urlencoded	1.2.2	linked
fraction	0.15.3	linked
fs_extra	1.3.0	linked
futures	0.3.32	linked
futures-channel	0.3.32	linked
futures-core	0.3.32	linked
futures-executor	0.3.32	linked
futures-io	0.3.32	linked
futures-sink	0.3.32	linked
futures-task	0.3.32	linked
futures-util	0.3.32	linked
gemm	0.17.1	linked
gemm	0.18.2	linked
gemm-c32	0.17.1	linked
gemm-c32	0.18.2	linked
gemm-c64	0.17.1	linked
gemm-c64	0.18.2	linked
gemm-common	0.17.1	linked
gemm-common	0.18.2	linked
gemm-f16	0.17.1	linked
gemm-f16	0.18.2	linked
gemm-f32	0.17.1	linked
gemm-f32	0.18.2	linked
gemm-f64	0.17.1	linked
gemm-f64	0.18.2	linked
getrandom	0.2.17	linked
glob	0.3.3	linked
h2	0.4.13	linked
half	2.7.1	linked
hash32	0.2.1	unknown
hashbrown	0.15.5	buildtime_only
hashbrown	0.16.1	linked
heck	0.5.0	linked
hermit-abi	0.5.2	platform_gated
hf-hub	0.4.3	linked
http	1.4.0	linked
http-body	1.0.1	linked
http-body-util	0.1.3	linked
hyper	1.8.1	linked
hyper-rustls	0.27.7	linked
hyper-util	0.1.20	linked
iana-time-zone	0.1.65	linked
icu_collections	2.1.1	linked
icu_locale_core	2.1.1	linked
icu_normalizer	2.1.1	linked
icu_properties	2.1.2	linked
icu_provider	2.1.1	linked
id-arena	2.3.0	buildtime_only
ident_case	1.0.1	linked
idna	1.1.0	linked
idna_adapter	1.2.1	linked
indexmap direct	2.13.0	linked
indicatif	0.17.11	linked
ipnet	2.12.0	linked
iri-string	0.7.10	linked
is_terminal_polyfill	1.70.2	linked
itertools	0.14.0	linked
itoa	1.0.18	linked
jni	0.21.1	platform_gated
jni-sys	0.3.0	platform_gated
jobserver	0.1.34	linked
js-sys	0.3.91	platform_gated
jsonschema	0.42.2	linked
lazy_static	1.5.0	linked
leb128fmt	0.1.0	buildtime_only
libloading	0.8.9	linked
libredox	0.1.14	platform_gated
linux-raw-sys	0.12.1	linked
litemap	0.8.1	linked
lock_api	0.4.14	linked
log	0.4.29	linked
macro_rules_attribute	0.2.2	linked
matchers	0.2.0	linked
memchr	2.8.0	linked
memmap2	0.9.10	linked
miniz_oxide	0.8.9	linked
mio	1.1.1	linked
monostate	0.1.18	linked
nom	7.1.3	linked
nu-ansi-term	0.50.3	linked
num	0.4.3	linked
num-bigint	0.4.6	linked
num-cmp	0.1.0	linked
num-complex	0.4.6	linked
num-integer	0.1.46	linked
num-iter	0.1.45	linked
num-rational	0.4.2	linked
num_cpus	1.17.0	linked
num_enum	0.7.6	linked
number_prefix	0.4.0	linked
once_cell	1.21.4	linked
once_cell_polyfill	1.70.2	platform_gated
onig	6.5.1	linked
openssl-probe	0.2.1	linked
option-ext	0.2.0	linked
outref	0.5.2	linked
parking_lot	0.12.5	linked
percent-encoding	2.3.2	linked
pin-project-lite	0.2.17	linked
pin-utils	0.1.0	linked
pkg-config	0.3.32	linked
postcard	1.1.3	unknown
potential_utf	0.1.4	linked
ppv-lite86	0.2.21	linked
proc-macro-crate	3.5.0	linked
pulp	0.18.22	linked
quick-xml	0.38.4	unknown
rand direct	0.8.5	linked
rand	0.9.2	linked
rand_chacha	0.3.1	linked
rand_chacha	0.9.0	linked
rand_core	0.6.4	linked
rand_core	0.9.5	linked
rand_distr	0.5.1	linked
raw-cpuid	10.7.0	linked
raw-cpuid	11.6.0	linked
rayon direct	1.11.0	linked
rayon-cond	0.4.0	linked
reborrow	0.5.5	linked
redox_syscall	0.5.18	platform_gated
redox_users	0.5.2	platform_gated
referencing	0.42.2	linked
regex	1.12.3	linked
regex-automata	0.4.14	linked
regex-syntax	0.8.10	linked
reqwest	0.13.2	linked
rustc_version	0.4.1	buildtime_only
rustls-native-certs	0.8.3	linked
rustls-pki-types	1.14.0	linked
rustls-platform-verifier	0.6.2	linked
rustls-platform-verifier-android	0.1.1	platform_gated
rustls-webpki	0.103.9	linked
ryu	1.0.23	linked
safetensors	0.4.5	linked
same-file	1.0.6	platform_gated
schannel	0.1.29	platform_gated
schemars	1.2.1	linked
scopeguard	1.2.0	linked
security-framework	3.7.0	platform_gated
security-framework-sys	2.17.0	platform_gated
semver	1.0.27	buildtime_only
serde_derive_internals	0.29.1	linked
serde_yaml	0.9.34+deprecated	linked
sha2	0.10.9	linked
sharded-slab	0.1.7	linked
shlex	1.3.0	linked
signal-hook-registry	1.4.8	linked
simd-adler32	0.3.8	linked
slab	0.4.12	linked
smallvec	1.15.1	linked
socket2	0.6.3	linked
socks	0.3.4	linked
spin	0.9.8	unknown
spm_precompiled	0.1.4	linked
stable_deref_trait	1.2.1	linked
static_assertions	1.1.0	linked
strsim	0.11.1	linked
subtle	2.6.1	linked
syn	2.0.117	linked
sync_wrapper	1.0.2	linked
synstructure	0.13.2	linked
tempfile direct	3.27.0	linked
thread_local	1.1.9	linked
tinystr	0.8.2	linked
tokenizers	0.21.4	linked
tokio direct	1.50.0	linked
tokio-rustls	0.26.4	linked
tokio-util	0.7.18	linked
toml_datetime	1.0.1+spec-1.1.0	linked
toml_edit	0.25.5+spec-1.1.0	linked
toml_parser	1.0.10+spec-1.1.0	linked
tower	0.5.3	linked
tower-http	0.6.8	linked
tower-layer	0.3.3	linked
tower-service	0.3.3	linked
tracing	0.1.44	linked
tracing-core	0.1.36	linked
tracing-log	0.2.0	linked
tracing-subscriber direct	0.3.23	linked
try-lock	0.2.5	linked
ug	0.1.0	linked
unicode-ident	1.0.24	linked
unicode-normalization-alignments	0.1.12	linked
unicode-segmentation	1.12.0	linked
unicode-width	0.2.0	linked
unicode-xid	0.2.6	buildtime_only
unicode_categories	0.1.1	linked
unsafe-libyaml	0.2.11	linked
untrusted	0.9.0	linked
ureq direct	2.12.1	linked
url	2.5.8	linked
utf8_iter	1.0.4	linked
utf8parse	0.2.2	linked
uuid direct	1.22.0	linked
uuid-simd	0.8.0	linked
version_check	0.9.5	linked
vsimd	0.8.0	linked
walkdir	2.5.0	platform_gated
want	0.3.1	linked
wasi	0.11.1+wasi-snapshot-preview1	platform_gated
wasip2	1.0.2+wasi-0.2.9	platform_gated
wasip3	0.4.0+wasi-0.3.0-rc-2026-01-06	platform_gated
wasm-bindgen-futures	0.4.64	platform_gated
wasm-bindgen-macro-support	0.2.114	buildtime_only
wasm-encoder	0.244.0	buildtime_only
wasm-metadata	0.244.0	buildtime_only
wasmparser	0.244.0	buildtime_only
web-sys	0.3.91	platform_gated
web-time	1.1.0	platform_gated
webpki-root-certs	1.0.6	platform_gated
webpki-roots	0.26.11	linked
webpki-roots	1.0.6	linked
winapi-util	0.1.11	platform_gated
windows-core	0.62.2	platform_gated
windows-link	0.2.1	platform_gated
windows-result	0.4.1	platform_gated
windows-strings	0.5.1	platform_gated
winnow	1.0.0	linked
wit-bindgen-core	0.51.0	buildtime_only
wit-component	0.244.0	buildtime_only
wit-parser	0.244.0	buildtime_only
writeable	0.6.2	linked
yoke	0.7.5	linked
yoke	0.8.1	linked
zerofrom	0.1.6	linked
zeroize	1.8.2	linked
zerotrie	0.2.3	linked
zerovec	0.11.5	linked
windows_aarch64_gnullvm	0.42.2	unverified	build script, not runprebuilt objects
windows_aarch64_gnullvm	0.52.6	unverified	build script, not runprebuilt objects
windows_aarch64_gnullvm	0.53.1	unverified	build script, not runprebuilt objects
windows_aarch64_msvc	0.42.2	unverified	build script, not runprebuilt objects
windows_aarch64_msvc	0.52.6	unverified	build script, not runprebuilt objects
windows_aarch64_msvc	0.53.1	unverified	build script, not runprebuilt objects
windows_i686_gnu	0.42.2	unverified	build script, not runprebuilt objects
windows_i686_gnu	0.52.6	unverified	build script, not runprebuilt objects
windows_i686_gnu	0.53.1	unverified	build script, not runprebuilt objects
windows_i686_gnullvm	0.52.6	unverified	build script, not runprebuilt objects
windows_i686_gnullvm	0.53.1	unverified	build script, not runprebuilt objects
windows_i686_msvc	0.42.2	unverified	build script, not runprebuilt objects
windows_i686_msvc	0.52.6	unverified	build script, not runprebuilt objects
windows_i686_msvc	0.53.1	unverified	build script, not runprebuilt objects
windows_x86_64_gnu	0.42.2	unverified	build script, not runprebuilt objects
windows_x86_64_gnu	0.52.6	unverified	build script, not runprebuilt objects
windows_x86_64_gnu	0.53.1	unverified	build script, not runprebuilt objects
windows_x86_64_gnullvm	0.42.2	unverified	build script, not runprebuilt objects
windows_x86_64_gnullvm	0.52.6	unverified	build script, not runprebuilt objects
windows_x86_64_gnullvm	0.53.1	unverified	build script, not runprebuilt objects
windows_x86_64_msvc	0.42.2	unverified	build script, not runprebuilt objects
windows_x86_64_msvc	0.52.6	unverified	build script, not runprebuilt objects
windows_x86_64_msvc	0.53.1	unverified	build script, not runprebuilt objects
libm	0.2.16	dead	build script
phonenumber	0.3.9+9.0.21	dead	build script
adler2	2.0.1	dead
bit-set	0.5.3	dead
bit-vec	0.6.3	dead
candle-transformers	0.8.4	dead
digits_iterator	0.1.0	dead
fancy-regex	0.13.0	dead
linked-hash-map	0.5.6	dead
lru-cache	0.1.2	dead
luhn	1.0.1	dead
minimal-lexical	0.2.1	dead
oncemutex	0.1.1	dead
r-efi	5.3.0	unverified
r-efi	6.0.0	unverified
regex-cache	0.2.1	dead
regex-syntax	0.6.29	dead
serde_plain	1.0.2	dead
strum	0.27.2	dead
sysctl	0.5.5	unverified
sysctl	0.6.0	unverified
windows-sys	0.45.0	unverified
windows-sys	0.52.0	unverified
windows-sys	0.59.0	unverified
windows-sys	0.60.2	unverified
windows-sys	0.61.2	unverified
windows-targets	0.42.2	unverified
windows-targets	0.52.6	unverified
windows-targets	0.53.5	unverified

1 of 1 jobs captured: build-test success · Generated 2026-10-13 · run 361684e6-7862-494e-8de6-b78d7ff0ba26

analysis 0.1.0 · 2026-10-11 · d6246d3 · graph v2