fix(security): Update Rust crate anyhow to v1.0.103 [SECURITY]

noplife commented

2026-07-27 15:22:08 +00:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
anyhow	dependencies	patch	`1.0.102` → `1.0.103`

Unsoundness in `Error::downcast_mut()`

RUSTSEC-2026-0190

More information

Details

Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via Error::context and then later calls Error::downcast_mut on the returned Error.

The flaw was corrected in commit 6e8c000 by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain.

Example

use anyhow::Error;
use std::fmt;

#[derive(Debug)]
struct ErrorContext(&'static str);

impl fmt::Display for ErrorContext {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        fmt::Display::fmt(&self.0, f)
    }
}

fn main() {
    let mut error = Error::msg("inner error").context(ErrorContext("old context"));
    let context: &mut ErrorContext = error.downcast_mut().unwrap();
    context.0 = "new context";
    println!("{:?}", error);
}

Miri output

error: Undefined Behavior: trying to retag from <1538> for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location
   --> src/ptr.rs:170:18
    |
170 |         unsafe { &mut *self.ptr.as_ptr() }
    |                  ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48]
    |
    = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
help: <1538> was created by a SharedReadOnly retag at offsets [0x38..0x48]
   --> src/ptr.rs:89:18
    |
 89 |             ptr: NonNull::from(ptr),
    |                  ^^^^^^^^^^^^^^^^^^
    = note: stack backtrace:
            0: anyhow::ptr::Mut::<'_, ErrorContext>::deref_mut
                at src/ptr.rs:170:18: 170:41
            1: anyhow::error::<impl anyhow::Error>::downcast_mut::<ErrorContext>
                at src/error.rs:560:18: 560:46
            2: main
                at examples/downcast_mut.rs:15:38: 15:58

Severity

Unknown

References

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

Release Notes

dtolnay/anyhow (anyhow)

`v1.0.103`

Compare Source

Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [anyhow](https://github.com/dtolnay/anyhow) | dependencies | patch | `1.0.102` → `1.0.103` | --- ### Unsoundness in `Error::downcast_mut()` [RUSTSEC-2026-0190](https://rustsec.org/advisories/RUSTSEC-2026-0190.html) <details> <summary>More information</summary> #### Details Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via `Error::context` and then later calls `Error::downcast_mut` on the returned `Error`. The flaw was corrected in commit `6e8c000` by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain. ##### Example ```rust use anyhow::Error; use std::fmt; #[derive(Debug)] struct ErrorContext(&'static str); impl fmt::Display for ErrorContext { fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { fmt::Display::fmt(&self.0, f) } } fn main() { let mut error = Error::msg("inner error").context(ErrorContext("old context")); let context: &mut ErrorContext = error.downcast_mut().unwrap(); context.0 = "new context"; println!("{:?}", error); } ``` ##### Miri output ``` error: Undefined Behavior: trying to retag from <1538> for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location --> src/ptr.rs:170:18 | 170 | unsafe { &mut *self.ptr.as_ptr() } | ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48] | = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information help: <1538> was created by a SharedReadOnly retag at offsets [0x38..0x48] --> src/ptr.rs:89:18 | 89 | ptr: NonNull::from(ptr), | ^^^^^^^^^^^^^^^^^^ = note: stack backtrace: 0: anyhow::ptr::Mut::<'_, ErrorContext>::deref_mut at src/ptr.rs:170:18: 170:41 1: anyhow::error::<impl anyhow::Error>::downcast_mut::<ErrorContext> at src/error.rs:560:18: 560:46 2: main at examples/downcast_mut.rs:15:38: 15:58 ``` #### Severity Unknown #### References - [https://crates.io/crates/anyhow](https://crates.io/crates/anyhow) - [https://rustsec.org/advisories/RUSTSEC-2026-0190.html](https://rustsec.org/advisories/RUSTSEC-2026-0190.html) - [https://github.com/dtolnay/anyhow/issues/451](https://github.com/dtolnay/anyhow/issues/451) This data is provided by [OSV](https://osv.dev/vulnerability/RUSTSEC-2026-0190) and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt)). </details> --- ### Release Notes <details> <summary>dtolnay/anyhow (anyhow)</summary> ### [`v1.0.103`](https://github.com/dtolnay/anyhow/releases/tag/1.0.103) [Compare Source](https://github.com/dtolnay/anyhow/compare/1.0.102...1.0.103) - Fix Stacked Borrows violation (UB) in `Error::downcast_mut` ([#451](https://github.com/dtolnay/anyhow/issues/451), [#452](https://github.com/dtolnay/anyhow/issues/452)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

noplife added 1 commit

2026-07-27 15:22:08 +00:00

fix(security): Update Rust crate anyhow to v1.0.103 [SECURITY]

CI / ubuntu-latest / stable (pull_request) Successful in 4m3s

Details

CI / macos-latest / stable (pull_request) Has been cancelled

Details

CI / windows-latest / stable (pull_request) Has been cancelled

Details

43c1ba31d8

noplife force-pushed renovate/crate-anyhow-vulnerability from 43c1ba31d8

CI / ubuntu-latest / stable (pull_request) Successful in 4m3s

Details

CI / macos-latest / stable (pull_request) Has been cancelled

Details

CI / windows-latest / stable (pull_request) Has been cancelled

Details

to 2aa4ef342d

CI / ubuntu-latest / stable (pull_request) Successful in 10m55s

Details

CI / windows-latest / stable (pull_request) Has been cancelled

Details

CI / macos-latest / stable (pull_request) Has been cancelled

Details

2026-07-29 03:26:56 +00:00

Compare

noplife commented

2026-07-30 01:35:51 +00:00

Author

Collaborator

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

### Edited/Blocked Notification Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠️ **Warning**: custom changes will be lost.

CI / ubuntu-latest / stable (pull_request) Successful in 10m55s

Details

CI / windows-latest / stable (pull_request) Has been cancelled

Details

CI / macos-latest / stable (pull_request) Has been cancelled

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/crate-anyhow-vulnerability:renovate/crate-anyhow-vulnerability

git switch renovate/crate-anyhow-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff renovate/crate-anyhow-vulnerability

git switch renovate/crate-anyhow-vulnerability

git rebase master

git switch master

git merge --ff-only renovate/crate-anyhow-vulnerability

git switch renovate/crate-anyhow-vulnerability

git rebase master

git switch master

git merge --no-ff renovate/crate-anyhow-vulnerability

git switch master

git merge --squash renovate/crate-anyhow-vulnerability

git switch master

git merge --ff-only renovate/crate-anyhow-vulnerability

git switch master

git merge renovate/crate-anyhow-vulnerability

git push origin master

Rows
Columns

fix(security): Update Rust crate anyhow to v1.0.103 [SECURITY] #18

Unsoundness in Error::downcast_mut()

Details

Example

Miri output

Severity

References

Release Notes

v1.0.103

Configuration

Edited/Blocked Notification

Checkout

Merge

Unsoundness in `Error::downcast_mut()`

`v1.0.103`