Update Rust crate tokio
to v1 [SECURITY]
#49
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.2.11
->1.18.5
⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
GHSA-4q83-7cq4-p6wg
tokio::io::ReadHalf<T>::unsplit
can violate thePin
contractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.
The
tokio
featureio-util
is also required to be enabled to trigger thissoundness issue.
Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures
0.1 that did not havePin
, so it is notaffected by this issue.
CVE-2021-45710
If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.
When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.
Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.
Release Notes
tokio-rs/tokio (tokio)
v1.18.5
Compare Source
v1.18.4
Compare Source
v1.18.3
: Tokio v1.18.3Compare Source
1.18.3 (September 27, 2022)
This release removes the dependency on the
once_cell
crate to restore the MSRV of the 1.18.x LTS release. (#5048)v1.18.2
: Tokio v1.18.2Compare Source
1.18.2 (May 5, 2022)
Add missing features for the
winapi
dependency. (#4663)v1.18.1
: Tokio v1.18.1Compare Source
1.18.1 (May 2, 2022)
The 1.18.0 release broke the build for targets without 64-bit atomics when building with
tokio_unstable
. This release fixes that. (#4649)v1.18.0
: Tokio v1.18.0Compare Source
1.18.0 (April 27, 2022)
This release adds a number of new APIs in
tokio::net
,tokio::signal
, andtokio::sync
. In addition, it adds new unstable APIs totokio::task
(Id
sfor uniquely identifying a task, and
AbortHandle
for remotely cancelling atask), as well as a number of bugfixes.
Fixed
#[track_caller]
forspawn_blocking
(#4616)select
macro to process 64 branches (#4519)try_io
methods not calling Mio'stry_io
internally (#4582)Added
UdpSocket::peer_addr
(#4611)try_read_buf
method for named pipes (#4626)SignalKind
Hash
/Eq
impls andc_int
conversion (#4540)SIGRTMAX
(#4555)watch::Sender::send_modify
method (#4310)broadcast::Receiver::len
method (#4542)watch::Receiver::same_channel
method (#4581)Clone
forRecvError
types (#4560)Changed
mio
to 0.8.1 (#4582)tokio::select!
's internalutil
module (#4543)Vec::with_capacity
when building runtime (#4553)Documented
tokio_unstable
(#4524)Handle::current
's docs to mentionEnterGuard
(#4567)Signal::recv
is cancel-safe (#4634)UnboundedReceiver
close docs (#4548)Unstable
The following changes only apply when building with
--cfg tokio_unstable
:task::Id
type (#4630)AbortHandle
type for cancelling tasks in aJoinSet
(#4530],[#4640)
doc(cfg(...))
attributes forJoinSet
(#4531)AbortHandle
RustDoc (#4545)v1.17.0
: Tokio v1.17.0Compare Source
1.17.0 (February 15, 2022)
This release updates the minimum supported Rust version (MSRV) to 1.49,
the
mio
dependency to v0.8, and the (optional)parking_lot
dependency to v0.12. Additionally, it contains several bug fixes, as
well as internal refactoring and performance improvements.
Fixed
sleep
with large durations (#4495)Instant
arithmetic on platformswhere
Instant::now
is not monotonic (#4461)DuplexStream
not participating in cooperative yielding(#4478)
JoinHandle
(#4430)Changed
parking_lot
dependency to v0.12.0 (#4459)mio
dependency to v0.8 (#4449)(#4480)
std::future::Ready
instead of our ownReady
future(#4271)
atomic::spin_loop_hint
withhint::spin_loop
(#4491)
Documented
tokio::process::ChildStdin
(#4479)Unstable
The following changes only apply when building with
--cfg tokio_unstable
:tracing
spans generated byspawn_local
(#4483)JoinSet
for managing sets of tasks (#4335)v1.16.1
: Tokio v1.16.1Compare Source
1.16.1 (January 28, 2022)
This release fixes a bug in #4428 with the change #4437.
v1.16.0
: Tokio v1.16.0Compare Source
Fixes a soundness bug in
io::Take
(#4428). The unsoundness is exposed whenleaking memory in the given
AsyncRead
implementation and then overwriting thesupplied buffer:
Also, this release includes improvements to the multi-threaded scheduler that
can increase throughput by up to 20% in some cases (#4383).
Fixed
io::Take
in edge case (#4428)File::write
results in awrite
syscall when the runtime shuts down (#4316)wait_with_output
(#4315)Send
fromparking_lot::*Guard
(#4359)Added
TcpSocket::linger()
andset_linger()
(#4324)UnwindSafe
for socket types (#4384)UnwindSafe
forJoinHandle
(#4418)watch::Receiver::has_changed()
(#4342)oneshot::Receiver::blocking_recv()
(#4334)RwLock
blocking operations (#4425)Unstable
The following changes only apply when building with
--cfg tokio_unstable
v1.15.0
: Tokio v1.15.0Compare Source
Fixed
io::empty()
(#4300)Changed
Added
Interval::reset()
(#4248)AsyncFdReadyGuard
(#4267)Command::as_std()
(#4295)Added (unstable)
tokio::sync
types (#4302)v1.14.1
: Tokio v1.14.1Compare Source
This release backports a bug fix from 1.16.1
Fixes a soundness bug in
io::Take
(#4428). The unsoundness is exposed whenleaking memory in the given
AsyncRead
implementation and then overwriting thesupplied buffer:
Fixed
io::Take
in edge case (#4428)v1.14.0
: Tokio v1.14.0Compare Source
1.14.0 (November 15, 2021)
Fixed
mut
patterns inselect!
(#4211)oneshot::Sender::send
and awaiting aoneshot::Receiver
when the oneshot has been closed (#4226)AtomicWaker
panic safe (#3689)(#4213)
Added
RuntimeStats::busy_duration_total
(#4179, #4223)Changed
copy
buffer size to matchstd::io::copy
(#4209)Documented
v1.13.1
: Tokio v1.13.1Compare Source
1.13.1 (November 15, 2021)
This release fixes a data race when sending and receiving on a
closed
oneshot
channel (RUSTSEC-2021-0124).Fixed
oneshot::Sender::send
and awaiting aoneshot::Receiver
when the oneshot has been closed (#4226)v1.13.0
: Tokio v1.13.0Compare Source
1.13.0 (October 29, 2021)
Fixed
Notify
to clone the waker before locking its waiter list (#4129)Added
poll_{recv,send}_ready
methods toudp
anduds_datagram
(#4131)try_*
,readable
,writable
,ready
, andpeer_addr
methods to split halves (#4120)blocking_lock
toMutex
(#4130)watch::Sender::send_replace
(#3962, #4195)Debug
forMutex<T>
impl to unsizedT
(#4134)Changed
copy_bidirectional
thatpoll_write
is sensible (#4125)select!
(#4192)block_on
wakeups better (#4157)Documented
try_join!
(#4133)tokio/src/lib.rs
(#4132)Interval::tick
cancel safety (#4152)v1.12.0
: Tokio v1.12.0Compare Source
1.12.0 (September 21, 2021)
Fixed
try_reserve
error is consistent withtry_send
(#4119)spin_loop_hint
instead ofyield_now
(#4115)SendError
field public (#4097)Added
AsyncSeekExt::rewind
(#4107)block_on
futures (#4094)try_recv
for mpsc channels (#4113)Changed
LocalSet
when using macro (#4027)Documented
poll_recv
(#4117)PollSender
implsSink
(#4110)yield_now
(#4091)v1.11.0
: Tokio v1.11.0Compare Source
1.11.0 (August 31, 2021)
Fixed
fill_buf
by not callingpoll_fill_buf
twice (#4084)Added
watch::Sender::subscribe
(#3800)from_std
toChildStd*
(#4045)Changed
Documented
v1.10.1
: Tokio v1.10.1Compare Source
1.10.1 (August 24, 2021)
Fixed
v1.10.0
: Tokio v1.10.0Compare Source
1.10.0 (August 12, 2021)
Added
(read|write)_f(32|64)[_le]
methods (#4022)fill_buf
andconsume
toAsyncBufReadExt
(#3991)Child::raw_handle()
on windows (#3998)Fixed
--cfg docsrs
(#4020)io::copy
(#4001)spin_loop_hint
instead ofyield_now
in mpsc (#4037)Changes
Documented
AsyncBufReadExt
(#3997)watch::send
fails (#4021)v1.9.0
: Tokio v1.9.0Compare Source
1.9.0 (July 19, 2021)
Added
TcpStream
(#3888)TaskLocal::scope
(#3273)Fixed
LocalSet
(#3978)Changes
OnceCell
(#3945)JoinError
(#3959)v1.8.5
: Tokio v1.8.5Compare Source
This release backports a bug fix from 1.16.1
Fixes a soundness bug in
io::Take
(#4428). The unsoundness is exposed whenleaking memory in the given
AsyncRead
implementation and then overwriting thesupplied buffer:
Fixed
io::Take
in edge case (#4428)v1.8.4
: Tokio v1.8.4Compare Source
1.8.4 (November 15, 2021)
This release backports a bugfix for a data race when sending and receiving on a
closed
oneshot
channel ([RUSTSEC-2021-0124]) from v1.13.1.Fixed
oneshot::Sender::send
and awaiting aoneshot::Receiver
when the oneshot has been closed (#4226)v1.8.3
: Tokio v1.8.3Compare Source
1.8.3 (July 22, 2021)
This release backports two fixes from 1.9.0
Fixed
LocalSet
(#3978)v1.8.2
: Tokio 1.8.2Compare Source
Fixes a missed edge case from 1.8.1.
Fixed
v1.8.1
: Tokio 1.8.1Compare Source
Forward ports 1.5.1 fixes.
Fixed
JoinHandle::abort
(#3934)v1.8.0
Compare Source
1.8.0 (July 2, 2021)
Added
get_{ref,mut}
methods toAsyncFdReadyGuard
andAsyncFdReadyMutGuard
(#3807)BufWriter
(#3163)NamedPipe{Client,Server}
(#3866, #3899)watch::Receiver::borrow_and_update
(#3813)From<T>
forOnceCell<T>
(#3877)Added (unstable)
tokio::task::Builder
(#3881)Fixed
UnixStream
(#3898)Documented
v1.7.3
: Tokio 1.7.3Compare Source
Fixes a missed edge case from 1.7.2.
Fixed
v1.7.2
: Tokio v1.7.2Compare Source
Forward ports 1.5.1 fixes.
Fixed
JoinHandle::abort
(#3934)v1.7.1
: Tokio v1.7.1Compare Source
Fixed
v1.7.0
: Tokio v1.7.0Compare Source
1.7.0 (June 15, 2021)
Added
TcpSocket
fromstd::net::TcpStream
conversion (#3838)receiver_count
towatch::Sender
(#3729)sync::notify::Notified
future publicly (#3840)Fixed
clippy::default_numeric_fallback
lint in generated code (#3831)mpsc::RecvError
type (#3833)Documented
AsyncReadExt::read_buf
(#3850)AsyncWrite::poll_write
(#3820)v1.6.4
: Tokio 1.6.4Compare Source
Fixes a missed edge case from 1.6.3.
Fixed
v1.6.3
: Tokio v1.6.3Compare Source
Forward ports 1.5.1 fixes.
Fixed
JoinHandle::abort
(#3934)v1.6.2
: Tokio v1.6.2Compare Source
Fixes
time:advance
regression introduced in 1.6 (#3852)v1.6.1
: Tokio v1.6.1Compare Source
This release reverts #3518 because it doesn't work on some kernels due to
a kernel bug. (#3803)
v1.6.0
: Tokio v1.6.0Compare Source
1.6.0 (May 14, 2021)
Added
write_all_buf
toAsyncWriteExt
(#3737)AsyncSeek
forBufReader
,BufWriter
, andBufStream
(#3491)mpsc::Sender::{reserve_owned, try_reserve_owned}
(#3704)MutexGuard::map
method that returns aMappedMutexGuard
(#2472)Fixed
DuplexStream
close (#3756)std::os::raw::c_int
instead oflibc::c_int
on public API (#3774)notify_waiters
(#3660)JoinHandle
panic message (#3727)time::advance
from going too far (#3712)Documented
net::unix::datagram
module from docs (#3775)Barrier
doc should use task, not thread (#3780)block_in_place
(#3753)v1.5.1
: Tokio v1.5.1Compare Source
Fixed
JoinHandle::abort
(#3934)v1.5.0
: Tokio v1.5.0Compare Source
1.5.0 (April 12, 2021)
Added
AsyncSeekExt::stream_position
(#3650)AsyncWriteExt::write_vectored
(#3678)copy_bidirectional
utility (#3572)IntoRawFd
forTcpSocket
(#3684)OnceCell
(#3591)OwnedRwLockReadGuard
andOwnedRwLockWriteGuard
(#3340)Semaphore::is_closed
(#3673)mpsc::Sender::capacity
(#3690)RwLock
max reads (#3644)sync_scope
forLocalKey
(#3612)Fixed
noalias
attributes on intrusive linked list (#3654)JoinHandle::abort()
when called from other threads (#3672)oneshot::try_recv
(#3674)Semaphore
permit overflow calculation (#3644)Documented
AsyncFd
(#3635){Handle,Runtime}::block_on
(#3628)Semaphore
is fair (#3693)v1.4.0
: Tokio v1.4.0Compare Source
Added
select!
(#3603)Handle::block_on
(#3569)Fixed
block_on
future (#3582)EnterGuard
withmust_use
(#3609)Documented
PollSender
(#3613)Mutex
FIFO explanation (#3615)v1.3.0
: Tokio v1.3.0Compare Source
Added
unconstrained()
opt-out (#3547)into_std
for net types without it (#3509)same_channel
method tompsc::Sender
(#3532){try_,}acquire_many_owned
toSemaphore
(#3535)RwLockWriteGuard::map
andRwLockWriteGuard::try_map
(#3348)Fixed
oneshot::Receiver::close
after successfultry_recv
(#3552)timeout(Duration::MAX)
(#3551)Documented
read_until
(#3536)AsyncRead::poll_read
doc (#3557)UdpSocket
splitting doc (#3517)LocalSet
onnew_current_thread
(#3508)join_all
forBarrier
(#3514)oneshot
(#3592)notify
tonotify_one
(#3526)Sleep
doc (#3515)interval.rs
andtime/mod.rs
docs (#3533)v1.2.0
: Tokio v1.2.0Compare Source
Added
Signal::poll_recv
method public (#3383)Fixed
test-util
paused time fully deterministic (#3492)Documented
v1.1.1
: Tokio v1.1.1Compare Source
Forward ports 1.0.3 fix.
Fixed
v1.1.0
: Tokio v1.1.0Compare Source
Added
try_read_buf
andtry_recv_buf
(#3351)Sender::try_reserve
function (#3418)RwLock
try_read
andtry_write
methods (#3400)ReadBuf::inner_mut
(#3443)Changed
select!
error message (#3352)read_to_end
(#3426)Fixed
LocalSet
onspawn_local
(#3369)Documented
Stream
wrappers intokio-stream
(#3343)test-util
feature is not enabled with full (#3397)AsyncFd
docs about changes of the inner fd (#3430)Sleep
is notUnpin
(#3457)PollSemaphore
(#3456)LocalSet
example (#3438)mpsc
documentation (#3458)v1.0.3
: Tokio v1.0.3Compare Source
Fixed
v1.0.2
: Tokio v1.0.2Compare Source
Fixed
read_to_end
(#3428).v1.0.1
: Tokio v1.0.1Compare Source
This release fixes a soundness hole caused by the combination of
RwLockWriteGuard::map
andRwLockWriteGuard::downgrade
by removing themap
function. This is a breaking change, but breaking changes are allowed under our semver policy when they are required to fix a soundness hole. (See this RFC for more.)Note that we have chosen not to do a deprecation cycle or similar because Tokio 1.0.0 was released two days ago, and therefore the impact should be minimal.
Due to the soundness hole, we have also yanked Tokio version 1.0.0.
Removed
RwLockWriteGuard::map
andRwLockWriteGuard::try_map
(#3345)Fixed
v1.0.0
: Tokio v1.0.0Compare Source
Commit to the API and long-term support.
Announcement and more details.
Fixed
watch
(#3234).Changed
AsyncFd::with_io()
totry_io()
(#3306)*Ext
traits in favor of conditionally defining the fn (#3264).Sleep
is!Unpin
(#3278).SocketAddr
by value (#3125).TcpStream::poll_peek
takesReadBuf
(#3259).runtime::Builder::max_threads()
tomax_blocking_threads()
(#3287).current_thread
runtime when callingtime::pause()
(#3289).Removed
tokio::prelude
(#3299).AsyncFd::with_poll()
(#3306).{Tcp,Unix}Stream::shutdown()
in favor ofAsyncWrite::shutdown()
(#3298).tokio-stream
untilStream
is added tostd
(#3277).try_recv()
due to unexpected behavior (#3263).tracing-core
is not 1.0 yet (#3266).Added
poll_*
fns toDirEntry
(#3308).poll_*
fns toio::Lines
,io::Split
(#3308)._mut
method variants toAsyncFd
(#3304).poll_*
fns toUnixDatagram
(#3223).UnixStream
readiness and non-blocking ops (#3246).UnboundedReceiver::blocking_recv()
(#3262).watch::Sender::borrow()
(#3269).Semaphore::close()
(#3065).poll_recv
fns tompsc::Receiver
,mpsc::UnboundedReceiver
(#3308).poll_tick
fn totime::Interval
(#3316).v0.3.7
Compare Source
v0.3.6
: Tokio v0.3.6Compare Source
Released December 14, 2020
Fixed
add_permits
panic with usize::MAX >> 3 permits (#3188)Added
TcpStream::into_std
(#3189)v0.3.5
: Tokio v0.3.5Compare Source
Fixed
shutdown_timeout(0)
(#3196).Added
AsyncFd::with_interest()
(#3167).CtrlC
stream on windows (#3186).v0.3.4
: Tokio v0.3.4Compare Source
Fixed
StreamMap
Default
impl bound (#3093).AsyncFd::into_inner()
should deregister the FD (#3104).Changed
parking_lot
feature enabled withfull
(#3119).Added
AsyncWrite
vectored writes (#3149).UCred
with solaris/illumos (#3085).runtime::Handle
allows spawning onto a runtime (#3079).Notify::notify_waiters()
(#3098).acquire_many()
,try_acquire_many()
toSemaphore
(#3067).v0.3.3
: Tokio v0.3.3Compare Source
Fixes a soundness hole by adding a missing
Send
bound toRuntime::spawn_blocking()
.Fixed
Send
, fixing soundness hole (#3089).Added
TcpSocket::reuseport()
,TcpSocket::set_reuseport()
(#3083).TcpSocket::reuseaddr()
(#3093).TcpSocket::local_addr()
(#3093).UCred
(#2633).v0.3.2
: Tokio v0.3.2Compare Source
Adds
AsyncFd
as a replacement for v0.2'sPollEvented
.Fixed
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.