GHSA-vj88-5667-w56p: Singleton lacks bounds on Send and Sync.
Singleton<T>
is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that static
items must implement Sync
,
Singleton
implemented both Sync
and Send
unconditionally.
This allows for a bug where non-Sync
types such as Cell
can be used in
singletons and cause data races in concurrent programs.
The flaw was corrected in commit b0d2bd20e
by adding trait bounds, requiring
the contaiend type to implement Sync
.
References
Detect and mitigate GHSA-vj88-5667-w56p with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →