Skip to content

Commit feffc0b

Browse files
EliteTKEliteTK
authored
Bump async_http_range_reader to 0.11.1 (#21401)
## Summary This version of async_http_range_reader fixes a memory un-safety bug which can be triggered when trying to range-request metadata out of a malicious wheel or from a malicious wheel host. I have not been able to rule out that we're affected, but I have also not been able to get us to trigger it. The difficulty is mainly down to us using a single threaded executor. ## Test Plan Test suite.
1 parent 1c7cfe3 commit feffc0b

2 files changed

Lines changed: 3 additions & 3 deletions

File tree

‎Cargo.lock‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ async-compression = { version = "0.4.12", features = [
107107
"zstd",
108108
] }
109109
async-trait = { version = "0.1.82" }
110-
async_http_range_reader = { version = "0.11.0", package = "astral_async_http_range_reader" }
110+
async_http_range_reader = { version = "0.11.1", package = "astral_async_http_range_reader" }
111111
async_zip = { version = "0.0.20", package = "astral_async_zip", features = [
112112
"deflate",
113113
"tokio",

0 commit comments

Comments
 (0)