RustSec

Growth in the @RustSec security advisory database year-over-year throughout its 6-year history

The rustsec.org web site now features severity information for each security advisory

Growth in the @RustSec security advisory database year-over-year throughout its 5-year history

A look at the number of vulnerabilities filed in the RustSec Advisory Database: 2016-2019

We've just published our first "informational advisories": warnings about unmaintained crates or other issues which aren't security vulnerabilities in and of themselves. To see them, you'll need to get the latest release of cargo-audit: v0.9.3

We just released released v0.9.0 of cargo-audit: the RustSec Advisory DB client. It has several new features including support for displaying inverse dependency trees which show how vulnerable crates are included in your project. Full changelog here: github.com/RustSec/cargo-aud…

cargo-audit v0.9.0-beta1 is out, with a feature for showing inverse dependency relationships between vulnerable crates and your project ala cargo-tree github.com/RustSec/cargo-aud…

Are you getting cargo-audit failures for RUSTSEC-2019-0012: memoffset, don't think you're impacted by it, and don't have a resolution? You're not alone. If you have cargo-audit v0.7.0, you can use the --ignore option to temporarily ignore this particular advisory.

"cargo audit" is now installable as a cargo subcommand: github.com/RustSec/cargo-aud…