Debian Patches
Status for rust-cargo/0.96.0-1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| auto/auto-remove-targets.patch | This patch was autogenerated using debcargo via `remove_targets`. Do not edit manually! | no | ||||
| disable-vendor.patch | Drop vendored OpenSSL/libgit2 and openssl-src | Simon Quigley <tsimonq2@debian.org> | not-needed | vendor | 2026-08-18 | |
| drop-tracing-chrome.patch | no | |||||
| rand-0.10.patch | no | |||||
| CVE-2026-5222-avoid-stripping-.git-suffix-when-for-non-gi.patch | CVE-2026-5222: avoid stripping .git suffix when for non git registries | Arlo Siemsen <arkixml@gmail.com> | no | 2026-05-25 | ||
| CVE-2026-5223-prohibit-unpacking-symlinks-and-other-unexp.patch | CVE-2026-5223: prohibit unpacking symlinks and other unexpected entries Cargo has historically not allowed creating .crate packages containing symlinks. (It packages the symlink target in place of the symlink, instead.) So, any package containing a symlink would have to be hand-constructed. Such packages are also not allowed on crates.io, so it could only come from an alternate registry. Rather than dealing with symlink traversal attacks when unpacking a crate, just prohibit symlinks entirely. In the process, also prohibit other kinds of unusual entries. As an exception, allow character devices but warn about them, because some exist in crates on crates.io. |
Josh Triplett <josh@joshtriplett.org> | no | 2026-03-30 | ||
| git2-0.21-git2-curl-0.22.patch | Port to git2 0.21 | "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> | not-needed | backport, https://github.com/rust-lang/cargo/commit/0b1123a48825309b697312b44fdb64b3df00c958 | 2026-08-18 | |
| upgrade-gix.patch | Upgrade gix to 0.86 / gix-transport to 0.58 | Simon Quigley <tsimonq2@debian.org> | not-needed | vendor | 2026-08-18 | |
| relax-other-deps.patch | Relax dependencies | Simon Quigley <tsimonq2@debian.org> | not-needed | vendor | 2026-08-21 |