Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rust crate tokio to v1 [SECURITY] #49

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 6, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
tokio (source) dependencies major 0.2.11 -> 1.18.5

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-4q83-7cq4-p6wg

tokio::io::ReadHalf<T>::unsplit can violate the Pin contract

The soundness issue is described in the tokio/issues#5372

Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.

The tokio feature io-util is also required to be enabled to trigger this
soundness issue.

Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.

Tokio before 0.2.0 used futures 0.1 that did not have Pin, so it is not
affected by this issue.

CVE-2021-45710

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.


Release Notes

tokio-rs/tokio (tokio)

v1.18.5

Compare Source

v1.18.4

Compare Source

v1.18.3: Tokio v1.18.3

Compare Source

1.18.3 (September 27, 2022)

This release removes the dependency on the once_cell crate to restore the MSRV of the 1.18.x LTS release. (#​5048)

v1.18.2: Tokio v1.18.2

Compare Source

1.18.2 (May 5, 2022)

Add missing features for the winapi dependency. (#​4663)

v1.18.1: Tokio v1.18.1

Compare Source

1.18.1 (May 2, 2022)

The 1.18.0 release broke the build for targets without 64-bit atomics when building with tokio_unstable. This release fixes that. (#​4649)

v1.18.0: Tokio v1.18.0

Compare Source

1.18.0 (April 27, 2022)

This release adds a number of new APIs in tokio::net, tokio::signal, and
tokio::sync. In addition, it adds new unstable APIs to tokio::task (Ids
for uniquely identifying a task, and AbortHandle for remotely cancelling a
task), as well as a number of bugfixes.

Fixed
  • blocking: add missing #[track_caller] for spawn_blocking (#​4616)
  • macros: fix select macro to process 64 branches (#​4519)
  • net: fix try_io methods not calling Mio's try_io internally (#​4582)
  • runtime: recover when OS fails to spawn a new thread (#​4485)
Added
  • net: add UdpSocket::peer_addr (#​4611)
  • net: add try_read_buf method for named pipes (#​4626)
  • signal: add SignalKind Hash/Eq impls and c_int conversion (#​4540)
  • signal: add support for signals up to SIGRTMAX (#​4555)
  • sync: add watch::Sender::send_modify method (#​4310)
  • sync: add broadcast::Receiver::len method (#​4542)
  • sync: add watch::Receiver::same_channel method (#​4581)
  • sync: implement Clone for RecvError types (#​4560)
Changed
  • update mio to 0.8.1 (#​4582)
  • macros: rename tokio::select!'s internal util module (#​4543)
  • runtime: use Vec::with_capacity when building runtime (#​4553)
Documented
  • improve docs for tokio_unstable (#​4524)
  • runtime: include more documentation for thread_pool/worker (#​4511)
  • runtime: update Handle::current's docs to mention EnterGuard (#​4567)
  • time: clarify platform specific timer resolution (#​4474)
  • signal: document that Signal::recv is cancel-safe (#​4634)
  • sync: UnboundedReceiver close docs (#​4548)
Unstable

The following changes only apply when building with --cfg tokio_unstable:

  • task: add task::Id type (#​4630)
  • task: add AbortHandle type for cancelling tasks in a JoinSet (#​4530],
    [#​4640)
  • task: fix missing doc(cfg(...)) attributes for JoinSet (#​4531)
  • task: fix broken link in AbortHandle RustDoc (#​4545)
  • metrics: add initial IO driver metrics (#​4507)

v1.17.0: Tokio v1.17.0

Compare Source

1.17.0 (February 15, 2022)

This release updates the minimum supported Rust version (MSRV) to 1.49,
the mio dependency to v0.8, and the (optional) parking_lot
dependency to v0.12. Additionally, it contains several bug fixes, as
well as internal refactoring and performance improvements.

Fixed
  • time: prevent panicking in sleep with large durations (#​4495)
  • time: eliminate potential panics in Instant arithmetic on platforms
    where Instant::now is not monotonic (#​4461)
  • io: fix DuplexStream not participating in cooperative yielding
    (#​4478)
  • rt: fix potential double panic when dropping a JoinHandle (#​4430)
Changed
  • update minimum supported Rust version to 1.49 (#​4457)
  • update parking_lot dependency to v0.12.0 (#​4459)
  • update mio dependency to v0.8 (#​4449)
  • rt: remove an unnecessary lock in the blocking pool (#​4436)
  • rt: remove an unnecessary enum in the basic scheduler (#​4462)
  • time: use bit manipulation instead of modulo to improve performance
    (#​4480)
  • net: use std::future::Ready instead of our own Ready future
    (#​4271)
  • replace deprecated atomic::spin_loop_hint with hint::spin_loop
    (#​4491)
  • fix miri failures in intrusive linked lists (#​4397)
Documented
  • io: add an example for tokio::process::ChildStdin (#​4479)
Unstable

The following changes only apply when building with --cfg tokio_unstable:

  • task: fix missing location information in tracing spans generated by
    spawn_local (#​4483)
  • task: add JoinSet for managing sets of tasks (#​4335)
  • metrics: fix compilation error on MIPS (#​4475)
  • metrics: fix compilation error on arm32v7 (#​4453)

v1.16.1: Tokio v1.16.1

Compare Source

1.16.1 (January 28, 2022)

This release fixes a bug in #​4428 with the change #​4437.

v1.16.0: Tokio v1.16.0

Compare Source

Fixes a soundness bug in io::Take (#​4428). The unsoundness is exposed when
leaking memory in the given AsyncRead implementation and then overwriting the
supplied buffer:

impl AsyncRead for Buggy {
    fn poll_read(
        self: Pin<&mut Self>,
        cx: &mut Context<'_>,
        buf: &mut ReadBuf<'_>
    ) -> Poll<Result<()>> {
      let new_buf = vec![0; 5].leak();
      *buf = ReadBuf::new(new_buf);
      buf.put_slice(b"hello");
      Poll::Ready(Ok(()))
    }
}

Also, this release includes improvements to the multi-threaded scheduler that
can increase throughput by up to 20% in some cases (#​4383).

Fixed
  • io: soundness don't expose uninitialized memory when using io::Take in edge case (#​4428)
  • fs: ensure File::write results in a write syscall when the runtime shuts down (#​4316)
  • process: drop pipe after child exits in wait_with_output (#​4315)
  • rt: improve error message when spawning a thread fails (#​4398)
  • rt: reduce false-positive thread wakups in the multi-threaded scheduler (#​4383)
  • sync: don't inherit Send from parking_lot::*Guard (#​4359)
Added
  • net: TcpSocket::linger() and set_linger() (#​4324)
  • net: impl UnwindSafe for socket types (#​4384)
  • rt: impl UnwindSafe for JoinHandle (#​4418)
  • sync: watch::Receiver::has_changed() (#​4342)
  • sync: oneshot::Receiver::blocking_recv() (#​4334)
  • sync: RwLock blocking operations (#​4425)
Unstable

The following changes only apply when building with --cfg tokio_unstable

  • rt: breaking change overhaul runtime metrics API (#​4373)

v1.15.0: Tokio v1.15.0

Compare Source

Fixed
  • io: add cooperative yielding support to io::empty() (#​4300)
  • time: make timeout robust against budget-depleting tasks (#​4314)
Changed
  • update minimum supported Rust version to 1.46.
Added
  • time: add Interval::reset() (#​4248)
  • io: add explicit lifetimes to AsyncFdReadyGuard (#​4267)
  • process: add Command::as_std() (#​4295)
Added (unstable)
  • tracing: instrument tokio::sync types (#​4302)

v1.14.1: Tokio v1.14.1

Compare Source

This release backports a bug fix from 1.16.1

Fixes a soundness bug in io::Take (#​4428). The unsoundness is exposed when
leaking memory in the given AsyncRead implementation and then overwriting the
supplied buffer:

impl AsyncRead for Buggy {
    fn poll_read(
        self: Pin<&mut Self>,
        cx: &mut Context<'_>,
        buf: &mut ReadBuf<'_>
    ) -> Poll<Result<()>> {
      let new_buf = vec![0; 5].leak();
      *buf = ReadBuf::new(new_buf);
      buf.put_slice(b"hello");
      Poll::Ready(Ok(()))
    }
}
Fixed
  • io: soundness don't expose uninitialized memory when using io::Take in edge case (#​4428)

v1.14.0: Tokio v1.14.0

Compare Source

1.14.0 (November 15, 2021)

Fixed
  • macros: fix compiler errors when using mut patterns in select! (#​4211)
  • sync: fix a data race between oneshot::Sender::send and awaiting a
    oneshot::Receiver when the oneshot has been closed (#​4226)
  • sync: make AtomicWaker panic safe (#​3689)
  • runtime: fix basic scheduler dropping tasks outside a runtime context
    (#​4213)
Added
Changed
  • io: updated copy buffer size to match std::io::copy (#​4209)
Documented
  • io: rename buffer to file in doc-test (#​4230)
  • sync: fix Notify example (#​4212)

v1.13.1: Tokio v1.13.1

Compare Source

1.13.1 (November 15, 2021)

This release fixes a data race when sending and receiving on a
closed oneshot channel (RUSTSEC-2021-0124).

Fixed
  • sync: fix a data race between oneshot::Sender::send and awaiting a
    oneshot::Receiver when the oneshot has been closed (#​4226)

v1.13.0: Tokio v1.13.0

Compare Source

1.13.0 (October 29, 2021)

Fixed
  • sync: fix Notify to clone the waker before locking its waiter list (#​4129)
  • tokio: add riscv32 to non atomic64 architectures (#​4185)
Added
  • net: add poll_{recv,send}_ready methods to udp and uds_datagram (#​4131)
  • net: add try_*, readable, writable, ready, and peer_addr methods to split halves (#​4120)
  • sync: add blocking_lock to Mutex (#​4130)
  • sync: add watch::Sender::send_replace (#​3962, #​4195)
  • sync: expand Debug for Mutex<T> impl to unsized T (#​4134)
  • tracing: instrument time::Sleep (#​4072)
  • tracing: use structured location fields for spawned tasks (#​4128)
Changed
  • io: add assert in copy_bidirectional that poll_write is sensible (#​4125)
  • macros: use qualified syntax when polling in select! (#​4192)
  • runtime: handle block_on wakeups better (#​4157)
  • task: allocate callback on heap immediately in debug mode (#​4203)
  • tokio: assert platform-minimum requirements at build time (#​3797)
Documented
  • docs: conversion of doc comments to indicative mood (#​4174)
  • docs: add returning on the first error example for try_join! (#​4133)
  • docs: fixing broken links in tokio/src/lib.rs (#​4132)
  • signal: add example with background listener (#​4171)
  • sync: add more oneshot examples (#​4153)
  • time: document Interval::tick cancel safety (#​4152)

v1.12.0: Tokio v1.12.0

Compare Source

1.12.0 (September 21, 2021)

Fixed
  • mpsc: ensure try_reserve error is consistent with try_send (#​4119)
  • mpsc: use spin_loop_hint instead of yield_now (#​4115)
  • sync: make SendError field public (#​4097)
Added
  • io: add POSIX AIO on FreeBSD (#​4054)
  • io: add convenience method AsyncSeekExt::rewind (#​4107)
  • runtime: add tracing span for block_on futures (#​4094)
  • runtime: callback when a worker parks and unparks (#​4070)
  • sync: implement try_recv for mpsc channels (#​4113)
Changed
  • macros: run runtime inside LocalSet when using macro (#​4027)
Documented
  • docs: clarify CPU-bound tasks on Tokio (#​4105)
  • mpsc: document spurious failures on poll_recv (#​4117)
  • mpsc: document that PollSender impls Sink (#​4110)
  • task: document non-guarantees of yield_now (#​4091)
  • time: document paused time details better (#​4061, #​4103)

v1.11.0: Tokio v1.11.0

Compare Source

1.11.0 (August 31, 2021)

Fixed
  • time: don't panic when Instant is not monotonic (#​4044)
  • io: fix panic in fill_buf by not calling poll_fill_buf twice (#​4084)
Added
  • watch: add watch::Sender::subscribe (#​3800)
  • process: add from_std to ChildStd* (#​4045)
  • stats: initial work on runtime stats (#​4043)
Changed
Documented
  • time: make Sleep examples easier to find (#​4040)

v1.10.1: Tokio v1.10.1

Compare Source

1.10.1 (August 24, 2021)

Fixed
  • runtime: fix leak in UnownedTask (#​4063)

v1.10.0: Tokio v1.10.0

Compare Source

1.10.0 (August 12, 2021)

Added
  • io: add (read|write)_f(32|64)[_le] methods (#​4022)
  • io: add fill_buf and consume to AsyncBufReadExt (#​3991)
  • process: add Child::raw_handle() on windows (#​3998)
Fixed
  • doc: fix non-doc builds with --cfg docsrs (#​4020)
  • io: flush eagerly in io::copy (#​4001)
  • runtime: a debug assert was sometimes triggered during shutdown (#​4005)
  • sync: use spin_loop_hint instead of yield_now in mpsc (#​4037)
  • tokio: the test-util feature depends on rt, sync, and time (#​4036)
Changes
  • runtime: reorganize parts of the runtime (#​3979, #​4005)
  • signal: make windows docs for signal module show up on unix builds (#​3770)
  • task: quickly send task to heap on debug mode (#​4009)
Documented
  • io: document cancellation safety of AsyncBufReadExt (#​3997)
  • sync: document when watch::send fails (#​4021)

v1.9.0: Tokio v1.9.0

Compare Source

1.9.0 (July 19, 2021)

Added
  • net: allow customized I/O operations for TcpStream (#​3888)
  • sync: add getter for the mutex from a guard (#​3928)
  • task: expose nameable future for TaskLocal::scope (#​3273)
Fixed
  • Fix leak if output of future panics on drop (#​3967)
  • Fix leak in LocalSet (#​3978)
Changes

v1.8.5: Tokio v1.8.5

Compare Source

This release backports a bug fix from 1.16.1

Fixes a soundness bug in io::Take (#​4428). The unsoundness is exposed when
leaking memory in the given AsyncRead implementation and then overwriting the
supplied buffer:

impl AsyncRead for Buggy {
    fn poll_read(
        self: Pin<&mut Self>,
        cx: &mut Context<'_>,
        buf: &mut ReadBuf<'_>
    ) -> Poll<Result<()>> {
      let new_buf = vec![0; 5].leak();
      *buf = ReadBuf::new(new_buf);
      buf.put_slice(b"hello");
      Poll::Ready(Ok(()))
    }
}
Fixed
  • io: soundness don't expose uninitialized memory when using io::Take in edge case (#​4428)

v1.8.4: Tokio v1.8.4

Compare Source

1.8.4 (November 15, 2021)

This release backports a bugfix for a data race when sending and receiving on a
closed oneshot channel ([RUSTSEC-2021-0124]) from v1.13.1.

Fixed
  • sync: fix a data race between oneshot::Sender::send and awaiting a
    oneshot::Receiver when the oneshot has been closed (#​4226)

v1.8.3: Tokio v1.8.3

Compare Source

1.8.3 (July 22, 2021)

This release backports two fixes from 1.9.0

Fixed
  • Fix leak if output of future panics on drop (#​3967)
  • Fix leak in LocalSet (#​3978)

v1.8.2: Tokio 1.8.2

Compare Source

Fixes a missed edge case from 1.8.1.

Fixed
  • runtime: drop canceled future on next poll (#​3965)

v1.8.1: Tokio 1.8.1

Compare Source

Forward ports 1.5.1 fixes.

Fixed
  • runtime: remotely abort tasks on JoinHandle::abort (#​3934)

v1.8.0

Compare Source

1.8.0 (July 2, 2021)

Added
  • io: add get_{ref,mut} methods to AsyncFdReadyGuard and AsyncFdReadyMutGuard (#​3807)
  • io: efficient implementation of vectored writes for BufWriter (#​3163)
  • net: add ready/try methods to NamedPipe{Client,Server} (#​3866, #​3899)
  • sync: add watch::Receiver::borrow_and_update (#​3813)
  • sync: implement From<T> for OnceCell<T> (#​3877)
  • time: allow users to specify Interval behaviour when delayed (#​3721)
Added (unstable)
  • rt: add tokio::task::Builder (#​3881)
Fixed
  • net: handle HUP event with UnixStream (#​3898)
Documented
  • doc: document cancellation safety (#​3900)
  • time: add wait alias to sleep (#​3897)
  • time: document auto-advancing behaviour of runtime (#​3763)

v1.7.3: Tokio 1.7.3

Compare Source

Fixes a missed edge case from 1.7.2.

Fixed
  • runtime: drop canceled future on next poll (#​3965)

v1.7.2: Tokio v1.7.2

Compare Source

Forward ports 1.5.1 fixes.

Fixed
  • runtime: remotely abort tasks on JoinHandle::abort (#​3934)

v1.7.1: Tokio v1.7.1

Compare Source

Fixed
  • runtime: fix early task shutdown during runtime shutdown (#​3870)

v1.7.0: Tokio v1.7.0

Compare Source

1.7.0 (June 15, 2021)

Added
  • net: add named pipes on windows (#​3760)
  • net: add TcpSocket from std::net::TcpStream conversion (#​3838)
  • sync: add receiver_count to watch::Sender (#​3729)
  • sync: export sync::notify::Notified future publicly (#​3840)
  • tracing: instrument task wakers (#​3836)
Fixed
  • macros: suppress clippy::default_numeric_fallback lint in generated code (#​3831)
  • runtime: immediately drop new tasks when runtime is shut down (#​3752)
  • sync: deprecate unused mpsc::RecvError type (#​3833)
Documented
  • io: clarify EOF condition for AsyncReadExt::read_buf (#​3850)
  • io: clarify limits on return values of AsyncWrite::poll_write (#​3820)
  • sync: add examples to Semaphore (#​3808)

v1.6.4: Tokio 1.6.4

Compare Source

Fixes a missed edge case from 1.6.3.

Fixed
  • runtime: drop canceled future on next poll (#​3965)

v1.6.3: Tokio v1.6.3

Compare Source

Forward ports 1.5.1 fixes.

Fixed
  • runtime: remotely abort tasks on JoinHandle::abort (#​3934)

v1.6.2: Tokio v1.6.2

Compare Source

Fixes
  • test: sub-ms time:advance regression introduced in 1.6 (#​3852)

v1.6.1: Tokio v1.6.1

Compare Source

This release reverts #​3518 because it doesn't work on some kernels due to
a kernel bug. (#​3803)

v1.6.0: Tokio v1.6.0

Compare Source

1.6.0 (May 14, 2021)

Added
  • fs: try doing a non-blocking read before punting to the threadpool (#​3518)
  • io: add write_all_buf to AsyncWriteExt (#​3737)
  • io: implement AsyncSeek for BufReader, BufWriter, and BufStream (#​3491)
  • net: support non-blocking vectored I/O (#​3761)
  • sync: add mpsc::Sender::{reserve_owned, try_reserve_owned} (#​3704)
  • sync: add a MutexGuard::map method that returns a MappedMutexGuard (#​2472)
  • time: add getter for Interval's period (#​3705)
Fixed
  • io: wake pending writers on DuplexStream close (#​3756)
  • process: avoid redundant effort to reap orphan processes (#​3743)
  • signal: use std::os::raw::c_int instead of libc::c_int on public API (#​3774)
  • sync: preserve permit state in notify_waiters (#​3660)
  • task: update JoinHandle panic message (#​3727)
  • time: prevent time::advance from going too far (#​3712)
Documented
  • net: hide net::unix::datagram module from docs (#​3775)
  • process: updated example (#​3748)
  • sync: Barrier doc should use task, not thread (#​3780)
  • task: update documentation on block_in_place (#​3753)

v1.5.1: Tokio v1.5.1

Compare Source

Fixed
  • runtime: remotely abort tasks on JoinHandle::abort (#​3934)

v1.5.0: Tokio v1.5.0

Compare Source

1.5.0 (April 12, 2021)

Added
  • io: add AsyncSeekExt::stream_position (#​3650)
  • io: add AsyncWriteExt::write_vectored (#​3678)
  • io: add a copy_bidirectional utility (#​3572)
  • net: implement IntoRawFd for TcpSocket (#​3684)
  • sync: add OnceCell (#​3591)
  • sync: add OwnedRwLockReadGuard and OwnedRwLockWriteGuard (#​3340)
  • sync: add Semaphore::is_closed (#​3673)
  • sync: add mpsc::Sender::capacity (#​3690)
  • sync: allow configuring RwLock max reads (#​3644)
  • task: add sync_scope for LocalKey (#​3612)
Fixed
  • chore: try to avoid noalias attributes on intrusive linked list (#​3654)
  • rt: fix panic in JoinHandle::abort() when called from other threads (#​3672)
  • sync: don't panic in oneshot::try_recv (#​3674)
  • sync: fix notifications getting dropped on receiver drop (#​3652)
  • sync: fix Semaphore permit overflow calculation (#​3644)
Documented
  • io: clarify requirements of AsyncFd (#​3635)
  • runtime: fix unclear docs for {Handle,Runtime}::block_on (#​3628)
  • sync: document that Semaphore is fair (#​3693)
  • sync: improve doc on blocking mutex (#​3645)

v1.4.0: Tokio v1.4.0

Compare Source

Added
  • macros: introduce biased argument for select! (#​3603)
  • runtime: add Handle::block_on (#​3569)
Fixed
  • runtime: avoid unnecessary polling of block_on future (#​3582)
  • runtime: fix memory leak/growth when creating many runtimes (#​3564)
  • runtime: mark EnterGuard with must_use (#​3609)
Documented
  • chore: mention fix for building docs in contributing guide (#​3618)
  • doc: add link to PollSender (#​3613)
  • doc: alias sleep to delay (#​3604)
  • sync: improve Mutex FIFO explanation (#​3615)
  • timer: fix double newline in module docs (#​3617)

v1.3.0: Tokio v1.3.0

Compare Source

Added
  • coop: expose an unconstrained() opt-out (#​3547)
  • net: add into_std for net types without it (#​3509)
  • sync: add same_channel method to mpsc::Sender (#​3532)
  • sync: add {try_,}acquire_many_owned to Semaphore (#​3535)
  • sync: add back RwLockWriteGuard::map and RwLockWriteGuard::try_map (#​3348)
Fixed
  • sync: allow oneshot::Receiver::close after successful try_recv (#​3552)
  • time: do not panic on timeout(Duration::MAX) (#​3551)
Documented
  • doc: doc aliases for pre-1.0 function names (#​3523)
  • io: fix typos (#​3541)
  • io: note the EOF behaviour of read_until (#​3536)
  • io: update AsyncRead::poll_read doc (#​3557)
  • net: update UdpSocket splitting doc (#​3517)
  • runtime: add link to LocalSet on new_current_thread (#​3508)
  • runtime: update documentation of thread limits (#​3527)
  • sync: do not recommend join_all for Barrier (#​3514)
  • sync: documentation for oneshot (#​3592)
  • sync: rename notify to notify_one (#​3526)
  • time: fix typo in Sleep doc (#​3515)
  • time: sync interval.rs and time/mod.rs docs (#​3533)

v1.2.0: Tokio v1.2.0

Compare Source

Added
  • signal: make Signal::poll_recv method public (#​3383)
Fixed
  • time: make test-util paused time fully deterministic (#​3492)
Documented
  • sync: link to new broadcast and watch wrappers (#​3504)

v1.1.1: Tokio v1.1.1

Compare Source

Forward ports 1.0.3 fix.

Fixed
  • io: memory leak during shutdown (#​3477).

v1.1.0: Tokio v1.1.0

Compare Source

Added
  • net: add try_read_buf and try_recv_buf (#​3351)
  • mpsc: Add Sender::try_reserve function (#​3418)
  • sync: add RwLock try_read and try_write methods (#​3400)
  • io: add ReadBuf::inner_mut (#​3443)
Changed
  • macros: improve select! error message (#​3352)
  • io: keep track of initialized bytes in read_to_end (#​3426)
  • runtime: consolidate errors for context missing (#​3441)
Fixed
  • task: wake LocalSet on spawn_local (#​3369)
  • sync: fix panic in broadcast::Receiver drop (#​3434)
Documented
  • stream: link to new Stream wrappers in tokio-stream (#​3343)
  • docs: mention that test-util feature is not enabled with full (#​3397)
  • process: add documentation to process::Child fields (#​3437)
  • io: clarify AsyncFd docs about changes of the inner fd (#​3430)
  • net: update datagram docs on splitting (#​3448)
  • time: document that Sleep is not Unpin (#​3457)
  • sync: add link to PollSemaphore (#​3456)
  • task: add LocalSet example (#​3438)
  • sync: improve bounded mpsc documentation (#​3458)

v1.0.3: Tokio v1.0.3

Compare Source

Fixed
  • io: memory leak during shutdown (#​3477).

v1.0.2: Tokio v1.0.2

Compare Source

Fixed
  • io: soundness in read_to_end (#​3428).

v1.0.1: Tokio v1.0.1

Compare Source

This release fixes a soundness hole caused by the combination of RwLockWriteGuard::map and RwLockWriteGuard::downgrade by removing the map function. This is a breaking change, but breaking changes are allowed under our semver policy when they are required to fix a soundness hole. (See this RFC for more.)

Note that we have chosen not to do a deprecation cycle or similar because Tokio 1.0.0 was released two days ago, and therefore the impact should be minimal.

Due to the soundness hole, we have also yanked Tokio version 1.0.0.

Removed
  • sync: remove RwLockWriteGuard::map and RwLockWriteGuard::try_map (#​3345)
Fixed
  • docs: remove stream feature from docs (#​3335)

v1.0.0: Tokio v1.0.0

Compare Source

Commit to the API and long-term support.

Announcement and more details.

Fixed
  • sync: spurious wakeup in watch (#​3234).
Changed
  • io: rename AsyncFd::with_io() to try_io() (#​3306)
  • fs: avoid OS specific *Ext traits in favor of conditionally defining the fn (#​3264).
  • fs: Sleep is !Unpin (#​3278).
  • net: pass SocketAddr by value (#​3125).
  • net: TcpStream::poll_peek takes ReadBuf (#​3259).
  • rt: rename runtime::Builder::max_threads() to max_blocking_threads() (#​3287).
  • time: require current_thread runtime when calling time::pause() (#​3289).
Removed
  • remove tokio::prelude (#​3299).
  • io: remove AsyncFd::with_poll() (#​3306).
  • net: remove {Tcp,Unix}Stream::shutdown() in favor of AsyncWrite::shutdown() (#​3298).
  • stream: move all stream utilities to tokio-stream until Stream is added to
    std (#​3277).
  • sync: mpsc try_recv() due to unexpected behavior (#​3263).
  • tracing: make unstable as tracing-core is not 1.0 yet (#​3266).
Added
  • fs: poll_* fns to DirEntry (#​3308).
  • io: poll_* fns to io::Lines, io::Split (#​3308).
  • io: _mut method variants to AsyncFd (#​3304).
  • net: poll_* fns to UnixDatagram (#​3223).
  • net: UnixStream readiness and non-blocking ops (#​3246).
  • sync: UnboundedReceiver::blocking_recv() (#​3262).
  • sync: watch::Sender::borrow() (#​3269).
  • sync: Semaphore::close() (#​3065).
  • sync: poll_recv fns to mpsc::Receiver, mpsc::UnboundedReceiver (#​3308).
  • time: poll_tick fn to time::Interval (#​3316).

v0.3.7

Compare Source

v0.3.6: Tokio v0.3.6

Compare Source

Released December 14, 2020

Fixed
  • rt: fix deadlock in shutdown (#​3228)
  • rt: fix panic in task abort when off rt (#​3159)
  • sync: make add_permits panic with usize::MAX >> 3 permits (#​3188)
  • time: Fix race condition in timer drop (#​3229)
  • watch: fix spurious wakeup (#​3244)
Added
  • example: add back udp-codec example (#​3205)
  • net: add TcpStream::into_std (#​3189)

v0.3.5: Tokio v0.3.5

Compare Source

Fixed
  • rt: fix shutdown_timeout(0) (#​3196).
  • time: fixed race condition with small sleeps (#​3069).
Added
  • io: AsyncFd::with_interest() (#​3167).
  • signal: CtrlC stream on windows (#​3186).

v0.3.4: Tokio v0.3.4

Compare Source

Fixed
  • stream: StreamMap Default impl bound (#​3093).
  • io: AsyncFd::into_inner() should deregister the FD (#​3104).
Changed
  • meta: parking_lot feature enabled with full (#​3119).
Added
  • io: AsyncWrite vectored writes (#​3149).
  • net: TCP/UDP readiness and non-blocking ops (#​3130, #​2743, #​3138).
  • net: TCP socket option (linger, send/recv buf size) (#​3145, #​3143).
  • net: PID field in UCred with solaris/illumos (#​3085).
  • rt: runtime::Handle allows spawning onto a runtime (#​3079).
  • sync: Notify::notify_waiters() (#​3098).
  • sync: acquire_many(), try_acquire_many() to Semaphore (#​3067).

v0.3.3: Tokio v0.3.3

Compare Source

Fixes a soundness hole by adding a missing Send bound to Runtime::spawn_blocking().

Fixed
  • rt: include missing Send, fixing soundness hole (#​3089).
  • tracing: avoid huge trace span names (#​3074).
Added
  • net: TcpSocket::reuseport(), TcpSocket::set_reuseport() (#​3083).
  • net: TcpSocket::reuseaddr() (#​3093).
  • net: TcpSocket::local_addr() (#​3093).
  • net: add pid to UCred (#​2633).

v0.3.2: Tokio v0.3.2

Compare Source

Adds AsyncFd as a replacement for v0.2's PollEvented.

Fixed
  • io: fix a potential deadlock when shutting down the I/O driver (#​2903).
  • sync: `RwLockWriteGuard::down

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate
Copy link
Contributor Author

renovate bot commented Oct 6, 2023

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: apps/sim-core/Cargo.lock
Command failed: docker run --rm --name=renovate_a_sidecar --label=renovate_a_child --memory=3584m -v "/tmp/worker/5e0ca5/fc505c/repos/github/hashintel/labs":"/tmp/worker/5e0ca5/fc505c/repos/github/hashintel/labs" -v "/tmp/worker/5e0ca5/fc505c/cache":"/tmp/worker/5e0ca5/fc505c/cache" -e CONTAINERBASE_CACHE_DIR -w "/tmp/worker/5e0ca5/fc505c/repos/github/hashintel/labs" ghcr.io/containerbase/sidecar:9.20.4 bash -l -c "install-tool rust 1.73.0 && cargo update --manifest-path apps/sim-core/packages/engine/Cargo.toml --workspace"
    Updating crates.io index
error: failed to select a version for `tokio`.
    ... required by package `hashintel-core v0.1.0 (/tmp/worker/5e0ca5/fc505c/repos/github/hashintel/labs/apps/sim-core/packages/engine)`
    ... which satisfies path dependency `hashintel-core` (locked to 0.1.0) of package `hashintel-core-wasm v0.1.0 (/tmp/worker/5e0ca5/fc505c/repos/github/hashintel/labs/apps/sim-core/packages/engine-web)`
versions that meet the requirements `^1.18.5` are: 1.32.0, 1.31.0, 1.30.0, 1.29.1, 1.29.0, 1.28.2, 1.28.1, 1.28.0, 1.27.0, 1.26.0, 1.25.2, 1.25.1, 1.25.0, 1.24.2, 1.24.1, 1.24.0, 1.23.1, 1.23.0, 1.22.0, 1.21.2, 1.21.1, 1.21.0, 1.20.6, 1.20.5, 1.20.4, 1.20.3, 1.20.2, 1.20.1, 1.20.0, 1.19.2, 1.19.1, 1.19.0, 1.18.6, 1.18.5

the package `hashintel-core` depends on `tokio`, with features: `rt-threaded` but `tokio` does not have these features.


failed to select a version for `tokio` which could resolve this conflict

@judeallred
Copy link
Collaborator

These security issues don't apply because they're components in the build environment of a static website.

@judeallred judeallred closed this Oct 6, 2023
@renovate
Copy link
Contributor Author

renovate bot commented Oct 6, 2023

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 1.x releases. But if you manually upgrade to 1.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the deps/rs/crate-tokio-vulnerability branch October 6, 2023 19:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant