Rollup merge of #159395 - renovate-bot:renovate/crate-tracing-subscriber-vulnerability, r=jieyouxu Update Rust crate tracing-subscriber [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.20` → `0.3.22` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.19` → `0.3.20` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.20` → `0.3.22` | --- ### Tracing logging user input may result in poisoning logs with ANSI escape sequences [CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) <details> <summary>More information</summary> #### Details ##### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator. ##### Patches `tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal. ##### Workarounds Avoid printing logs to terminal emulators without escaping ANSI control sequences. ##### References https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/ ##### Acknowledgments We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`. If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) - [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html) - [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>tokio-rs/tracing (tracing-subscriber)</summary> ### [`v0.3.22`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.22): tracing-subscriber 0.3.22 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.21...tracing-subscriber-0.3.22) ##### Important The previous release [0.3.21] was yanked as it depended explicitly on [tracing-0.1.42], which was yanked due to a breaking change (see [#&rust-lang/rust#8203;3424] for details). This release contains all the changes from the previous release, plus an update to the newer version of `tracing`. ##### Changed - `tracing`: updated to 0.1.43 ([#&rust-lang/rust#8203;3427]) [#&rust-lang/rust#8203;3424]: https://redirect.github.com/tokio-rs/tracing/pull/3424 [#&rust-lang/rust#8203;3427]: https://redirect.github.com/tokio-rs/tracing/pull/3427 [0.3.21]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21 [tracing-0.1.42]: https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42 ### [`v0.3.21`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21): tracing-subscriber 0.3.21 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.20...tracing-subscriber-0.3.21) ##### Fixed - Change registry exit to decrement local span ref only ([#&rust-lang/rust#8203;3331]) - Make Layered propagate `on_register_dispatch` ([#&rust-lang/rust#8203;3379]) ##### Changed - `tracing`: updated to 0.1.42 ([#&rust-lang/rust#8203;3418]) ##### Performance - Remove `clone_span` on enter ([#&rust-lang/rust#8203;3289]) ##### Documented - Fix a few small things in the format module ([#&rust-lang/rust#8203;3339]) - Fix extra closing brace in layer docs ([#&rust-lang/rust#8203;3350]) - Fix link in `FmtSpan` docs ([#&rust-lang/rust#8203;3411]) [#&rust-lang/rust#8203;3289]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3289 [#&rust-lang/rust#8203;3331]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3331 [#&rust-lang/rust#8203;3339]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3339 [#&rust-lang/rust#8203;3350]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3350 [#&rust-lang/rust#8203;3379]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3379 [#&rust-lang/rust#8203;3411]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3411 [#&rust-lang/rust#8203;3418]: https://redirect.github.com/tokio-rs/tracing/pull/#&rust-lang/rust#8203;3418 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Website | Getting started | Learn | Documentation | Contributing
This is the main source code repository for Rust. It contains the compiler, standard library, and documentation.
Performance: Fast and memory-efficient, suitable for critical services, embedded devices, and easily integrated with other languages.
Reliability: Our rich type system and ownership model ensure memory and thread safety, reducing bugs at compile-time.
Productivity: Comprehensive documentation, a compiler committed to providing great diagnostics, and advanced tooling including package manager and build tool (Cargo), auto-formatter (rustfmt), linter (Clippy) and editor support (rust-analyzer).
Read “Installation” from The Book.
If you really want to install from source (though this is not recommended), see INSTALL.md.
See https://www.rust-lang.org/community for a list of chat platforms and forums.
See CONTRIBUTING.md.
For a detailed explanation of the compiler's architecture and how to begin contributing, see the rustc-dev-guide.
Rust is primarily distributed under the terms of both the MIT license and the Apache License (Version 2.0), with portions covered by various BSD-like licenses.
See LICENSE-APACHE, LICENSE-MIT, and COPYRIGHT for details.
The Rust Foundation owns and protects the Rust and Cargo trademarks and logos (the “Rust Trademarks”).
If you want to use these names or brands, please read the Rust language trademark policy.
Third-party logos may be subject to third-party copyrights and trademarks. See Licenses for details.