Update Rust crate rtrb to v0.3.5 [SECURITY] #4

Open

renovate-bot wants to merge 1 commit from renovate/crate-rtrb-vulnerability into main

pull from: renovate/crate-rtrb-vulnerability

merge into: Evobug:main

Evobug:main

Evobug:renovate/crate-zip-vulnerability

Evobug:renovate/npm-pnpm-vulnerability

Evobug:renovate/crate-cxx-vulnerability

Evobug:renovate/crate-anyhow-vulnerability

Evobug:mickle/deps-dedupe-2026-10

Evobug:mickle/m150

Evobug:fix/voice-rtc-error-decoding-20260907

Evobug:nvenc-windows

Evobug:dc/exp/jetson_nvmm

Evobug:dc/feature/user_timestamp

Evobug:theo/device-info

Evobug:dc/sensor_capture_timestamp

Evobug:sxian/CLT-2692/improve-peer-connection-tests

Evobug:dc/nvenc_debug

Evobug:ladvoc/prost-upgrade

Evobug:knope/temp-a8be7264-d069-4e3c-b539-d3c54e8dfb90

Evobug:sxian/CLT-2618/changing_3_packets_to_1_packet_in_data_stream

Evobug:revert-733-duan/fix-linux-so-link-issue

Evobug:binhpham/uniffi-wakeword

Evobug:mike/rust_latency_measurement_example

Evobug:sxian/rust_latency_measurement_example

Evobug:lukas/test-knope

Evobug:dc/rockchip_encoder

Evobug:sxian/CLT-2585/avoid_offer_answer_races

Evobug:dc/jetson_encoder

Evobug:theo/dynamic-webrtc

Evobug:sxian/CLT-2534/add_compression_to_rpc_with_backward_compatibility

Evobug:theo/fix-complaints

Evobug:theo/no-verify

Evobug:dc/feature/low_latency

Evobug:dc/pi_encoder

Evobug:dc/user_timestamp_2

Evobug:copilot/add-event-listener-example

Evobug:dc/passthru_simulcast

Evobug:dc/passthru

Evobug:sxian/CLT-2533/update_livekit_models

Evobug:theo/h264-ingest

Evobug:ladvoc/copyright-year-2026

Evobug:ladvoc/uniffi-tier3-panic

Evobug:jacobgelman/clt-2513-allow-rpc-registration-before-room-connection

Evobug:jacobgelman/clt-2512-mark-vendored-dependencies

Evobug:ladvoc/data-tracks

Evobug:blaze/fix-uniffi-headers

Evobug:ladvoc/doc-examples

Evobug:ladvoc/build-test

Evobug:ladvoc/ffi-perf

Evobug:dc/jetson_nvenc

Evobug:dc/nvenc_h265_test

Evobug:dc/user_timestamp

Evobug:ladvoc/nextest

Evobug:dc/jetson_pipeline

Evobug:dc/jetson_pipeline2

Evobug:dc/jetson_exp2

Evobug:dc/jetson_exp

Evobug:ladvoc/participant-state

Evobug:dc/nvenc_simulcast_exp

Evobug:ladvoc/uniffi-resampler

Evobug:dc/fps_debug

Evobug:ladvoc/yuv-optimize

Evobug:ladvoc/ffi-metrics

Evobug:dc/local_camera

Evobug:dc/local_camera_exp1

Evobug:ladvoc/stream-dump

Evobug:duan/uniffi-bindgen-for-csharp

Evobug:rg/uniffi-typescript

Evobug:ladvoc/core-token

Evobug:ladvoc/build-754

Evobug:token-source

Evobug:ladvoc/cdylib-load-test

Evobug:ladvoc/test-room-options

Evobug:ladvoc/gen-protocol-fix

Evobug:ladvoc/participant-active

Evobug:typester/libwebrtc-update

Evobug:typester/release-plz-webrtc-sys

Evobug:theo/fix-win

Evobug:typester/fast-publish

Evobug:shubhra/sample-logs

Evobug:feat/metrics

Evobug:ladvoc/aec-dump

Evobug:feat/forward-participant

Evobug:typester/cleanup-changeset

Evobug:typester/ws-http-proxy-release

Evobug:typester/leak-test

Evobug:theo/bump-manylinux

Evobug:typester/fix-changeset

Evobug:theo/fix-yuv-path

Evobug:nbsp/add/wgpu-screenshare

Evobug:duan/aec3-experimental

Evobug:typester/fix-cpu-leak

Evobug:bcherry/nanpa-folders

Evobug:nbsp/fix/screenshare

Evobug:nbsp/add/fast-publish

Evobug:bcherry/android

Evobug:bcherry/clippy

Evobug:bcherry/rpc

Evobug:bcherry/disable-failing

Evobug:theo/expose-buffer-size

Evobug:theo/fix-timestamps

Evobug:nbsp/worktree/bssl-windows

Evobug:nbsp/fix/race

Evobug:update-protocol

Evobug:theo/audio-resampler

Evobug:theo/fix-events-race

Evobug:duan/fix-build-for-msvc

Evobug:theo/dylib

Evobug:theo/openssl

Evobug:theo/test-symbols

Evobug:theo/unused-code

Evobug:theo/fix-videobuffer

Evobug:theo/audio-ts

Evobug:theo/uwp

Evobug:theo/mediadevices

Conversation 0 Commits 1 Files changed 1 +2 -2

renovate-bot commented 2026-10-18 05:54:59 +02:00

Member

Copy link

This PR contains the following updates:

Package	Type	Update	Change
rtrb	dependencies	patch	0.3.3 → 0.3.5

---

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Double free / use-after-free in ReadChunk::commit when an element's Drop panics

RUSTSEC-2026-0274

More information

Details

ReadChunk::commit and ReadChunk::commit_all drop the committed elements
before advancing the consumer head. If an element's Drop panics during the
drop loop, head is never advanced, so the ring buffer still treats those slots
as holding live elements. When the RingBuffer is later dropped (it walks
head..tail and drops each slot), or a subsequent read_chunk() / commit()
touches the same slots, the already-dropped elements are dropped a second time —
a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

Mitigation

Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior
change in is_abandoned(), so users on 0.3.x should prefer 0.3.5.

Severity

Unknown

References

• https://crates.io/crates/rtrb
• https://rustsec.org/advisories/RUSTSEC-2026-0274.html
• https://github.com/mgeier/rtrb/issues/185

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Configuration

📅 Schedule: (in timezone Europe/Prague)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rtrb](https://github.com/mgeier/rtrb) | dependencies | patch | `0.3.3` → `0.3.5` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/7) for more information. --- ### Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics [RUSTSEC-2026-0274](https://rustsec.org/advisories/RUSTSEC-2026-0274.html) <details> <summary>More information</summary> #### Details `ReadChunk::commit` and `ReadChunk::commit_all` drop the committed elements before advancing the consumer head. If an element's `Drop` panics during the drop loop, `head` is never advanced, so the ring buffer still treats those slots as holding live elements. When the `RingBuffer` is later dropped (it walks `head..tail` and drops each slot), or a subsequent `read_chunk()` / `commit()` touches the same slots, the already-dropped elements are dropped a second time — a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust. ##### Mitigation Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior change in `is_abandoned()`, so users on 0.3.x should prefer 0.3.5. #### Severity Unknown #### References - [https://crates.io/crates/rtrb](https://crates.io/crates/rtrb) - [https://rustsec.org/advisories/RUSTSEC-2026-0274.html](https://rustsec.org/advisories/RUSTSEC-2026-0274.html) - [https://github.com/mgeier/rtrb/issues/185](https://github.com/mgeier/rtrb/issues/185) This data is provided by [OSV](https://osv.dev/vulnerability/RUSTSEC-2026-0274) and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt)). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Prague) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjYuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE2Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==-->

renovate-bot added 1 commit 2026-10-18 05:54:59 +02:00

Update Rust crate rtrb to v0.3.5 [SECURITY] ... 25ccb6f209

Generated by renovateBot

Some checks failed

Hide checks

uniffi-swift.yml / Update Rust crate rtrb to v0.3.5 [SECURITY] (pull_request) Failing after 0s

Details

uniffi-swift.yml / Update Rust crate rtrb to v0.3.5 [SECURITY] (push) Failing after 0s

Details

Builds / Build (aarch64-pc-windows-msvc) (pull_request) Failing after 18s

Details

Builds / Build (x86_64-pc-windows-msvc) (pull_request) Failing after 19s

Details

Tests / Test (x86_64-pc-windows-msvc) (pull_request) Failing after 19s

Details

Builds / Build (aarch64-apple-darwin) (pull_request) Failing after 10s

Details

Builds / Build (aarch64-apple-ios-sim) (pull_request) Failing after 9s

Details

Builds / Build (aarch64-apple-ios) (pull_request) Failing after 9s

Details

Builds / Build (x86_64-apple-darwin) (pull_request) Failing after 9s

Details

Tests / Test (aarch64-apple-darwin) (pull_request) Failing after 41s

Details

Builds / Build (aarch64-linux-android) (pull_request) Failing after 20s

Details

Builds / Build (armv7-linux-androideabi) (pull_request) Failing after 20s

Details

Changeset Check / Check for changeset (pull_request) Failing after 4s

Details

Builds / Build (x86_64-unknown-linux-gnu) (pull_request) Failing after 9s

Details

Builds / Build (x86_64-linux-android) (pull_request) Failing after 14s

Details

Generate FFI Proto (Node) / Generating protobuf (pull_request) Failing after 9s

Details

License Check / License Check (pull_request) Successful in 10s

Details

Rust Formatting / Check Formatting (pull_request) Successful in 16s

Details

Tests / Test (x86_64-unknown-linux-gnu) (pull_request) Failing after 23s

Details

Test API / failover (pull_request) Failing after 26s

Details

Builds / Build (aarch64-unknown-linux-gnu) (pull_request) Has been cancelled

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/crate-rtrb-vulnerability:renovate/crate-rtrb-vulnerability

git switch renovate/crate-rtrb-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/crate-rtrb-vulnerability

git switch renovate/crate-rtrb-vulnerability

git rebase main

git switch main

git merge --ff-only renovate/crate-rtrb-vulnerability

git switch renovate/crate-rtrb-vulnerability

git rebase main

git switch main

git merge --no-ff renovate/crate-rtrb-vulnerability

git switch main

git merge --squash renovate/crate-rtrb-vulnerability

git switch main

git merge --ff-only renovate/crate-rtrb-vulnerability

git switch main

git merge renovate/crate-rtrb-vulnerability

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Evobug/rust-sdks!4

No description provided.