GHSA-rr8g-9fpq-6wmg: Tokio broadcast channel calls clone in parallel, but does not require `Sync`
The broadcast channel internally calls clone
on the stored value when receiving it, and only requires T:Send
. This means that using the broadcast channel with values that are Send
but not Sync
can trigger unsoundness if the clone
implementation makes use of the value being !Sync
.
Thank you to Austin Bonander for finding and reporting this issue.
References
Code Behaviors & Features
Detect and mitigate GHSA-rr8g-9fpq-6wmg with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →