gix-attributes

Version	Released
`0.35.0` minor	Aug 22, 2026
`0.34.0` unknown	Jul 23, 2026
`0.33.2` unknown	Jun 22, 2026
`0.33.1` unknown	May 26, 2026
`0.33.0` unknown	Apr 27, 2026
`0.32.0` unknown	Apr 24, 2026
`0.31.0` unknown	Feb 22, 2026
`0.30.1` unknown	Feb 10, 2026
`0.30.0` unknown	Jan 22, 2026
`0.29.0` unknown	Dec 22, 2025
`0.28.1` unknown	Oct 23, 2025
`0.28.0` unknown	Oct 22, 2025
`0.27.0` unknown	Jul 15, 2025
`0.26.1` unknown	May 16, 2025
`0.26.0` unknown	Apr 26, 2025
`0.25.1` unknown yanked	Apr 25, 2025
`0.25.0` unknown	Apr 04, 2025
`0.24.0` unknown	Jan 18, 2025
`0.23.1` unknown	Nov 24, 2024
`0.23.0` unknown	Oct 22, 2024
`0.22.5` unknown	Aug 22, 2024
`0.22.4` unknown	Aug 22, 2024
`0.22.3` unknown	Jul 23, 2024
`0.22.2` unknown 1 CVE	Mar 14, 2024
`0.22.1` unknown 1 CVE	Feb 25, 2024
`0.22.0` unknown 1 CVE	Jan 20, 2024
`0.21.1` unknown 1 CVE	Dec 30, 2023
`0.21.0` unknown 1 CVE	Dec 29, 2023
`0.20.1` unknown 1 CVE	Dec 06, 2023
`0.20.0` unknown 1 CVE	Oct 12, 2023
`0.19.0` unknown 1 CVE	Sep 24, 2023
`0.18.0` unknown 1 CVE	Sep 08, 2023
`0.17.0` unknown 1 CVE	Aug 22, 2023
`0.16.0` unknown 1 CVE	Jul 22, 2023
`0.15.0` unknown 1 CVE	Jul 19, 2023
`0.14.1` unknown 1 CVE	Jun 29, 2023
`0.14.0` unknown 1 CVE	Jun 22, 2023
`0.13.1` unknown 1 CVE	Jun 10, 2023
`0.13.0` unknown 1 CVE	Jun 06, 2023
`0.12.0` unknown 1 CVE	Apr 27, 2023
`0.11.0` unknown 1 CVE	Apr 26, 2023
`0.10.0` unknown 1 CVE	Mar 04, 2023
`0.9.0` unknown 1 CVE	Mar 01, 2023
`0.8.3` unknown 1 CVE	Feb 20, 2023
`0.8.2` unknown 1 CVE	Feb 17, 2023

0.35.0 minor

Aug 22, 2026

0.34.0 unknown

Jul 23, 2026

0.33.2 unknown

Jun 22, 2026

0.33.1 unknown

May 26, 2026

0.33.0 unknown

Apr 27, 2026

0.32.0 unknown

Apr 24, 2026

0.31.0 unknown

Feb 22, 2026

0.30.1 unknown

Feb 10, 2026

0.30.0 unknown

Jan 22, 2026

0.29.0 unknown

Dec 22, 2025

0.28.1 unknown

Oct 23, 2025

0.28.0 unknown

Oct 22, 2025

0.27.0 unknown

Jul 15, 2025

0.26.1 unknown

May 16, 2025

0.26.0 unknown

Apr 26, 2025

0.25.1 unknown yanked

Apr 25, 2025

0.25.0 unknown

Apr 04, 2025

0.24.0 unknown

Jan 18, 2025

0.23.1 unknown

Nov 24, 2024

0.23.0 unknown

Oct 22, 2024

0.22.5 unknown

Aug 22, 2024

0.22.4 unknown

Aug 22, 2024

0.22.3 unknown

Jul 23, 2024

0.22.2 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 14, 2024

0.22.1 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 25, 2024

0.22.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 20, 2024

0.21.1 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 30, 2023

0.21.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 29, 2023

0.20.1 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 06, 2023

0.20.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 12, 2023

0.19.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 24, 2023

0.18.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 08, 2023

0.17.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 22, 2023

0.16.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 22, 2023

0.15.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 19, 2023

0.14.1 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 29, 2023

0.14.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 22, 2023

0.13.1 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 10, 2023

0.13.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 06, 2023

0.12.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 27, 2023

0.11.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 26, 2023

0.10.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 04, 2023

0.9.0 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 01, 2023

0.8.3 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 20, 2023

0.8.2 unknown

1 CVE

GHSA-cx7h-h87r-jpgr RUSTSEC-2024-0359 Jul 25, 2024

The kstring integration in gix-attributes is unsound

Low

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Fixed in


          0.22.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 17, 2023

Activity

Reach

Details