From a memory-safety audit of nobilis on 2 October 2026: its own code has two unsafe blocks (both sound libc calls in main.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in Cargo.lock, and each one traced to whether it is actually compiled in.
No known vulnerability in any of these, but nobody will fix one if it is found:
crate
advisory
reached through
instant 0.1.13
RUSTSEC-2024-0384
parking_lot (old), openmls, davey
paste 1.0.15
RUSTSEC-2024-0436
arti (fs-mistrust, tor-config) - build time only
proc-macro-error2 2.0.1
RUSTSEC-2026-0173
matrix-sdk-crypto (aquamarine) - build time only
rustls-pemfile 2.2.0
RUSTSEC-2025-0134
irc
bitmaps 3.2.1
RUSTSEC-2026-0247
matrix-sdk's imbl (see the matrix-sdk issue)
bincode 2.0.1 (RUSTSEC-2025-0141) is in the lockfile but not compiled in.
Most clear with the upgrades in the other issues (matrix-sdk 0.19, a newer davey). rustls-pemfile needs irc to move to rustls-pki-types, which may mean a patch upstream.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two `unsafe` blocks (both sound libc calls in `main.rs`), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in `Cargo.lock`, and each one traced to whether it is actually compiled in.
No known vulnerability in any of these, but nobody will fix one if it is found:
| crate | advisory | reached through |
| --- | --- | --- |
| `instant` 0.1.13 | RUSTSEC-2024-0384 | `parking_lot` (old), `openmls`, `davey` |
| `paste` 1.0.15 | RUSTSEC-2024-0436 | arti (`fs-mistrust`, `tor-config`) - build time only |
| `proc-macro-error2` 2.0.1 | RUSTSEC-2026-0173 | matrix-sdk-crypto (`aquamarine`) - build time only |
| `rustls-pemfile` 2.2.0 | RUSTSEC-2025-0134 | `irc` |
| `bitmaps` 3.2.1 | RUSTSEC-2026-0247 | matrix-sdk's `imbl` (see the matrix-sdk issue) |
`bincode` 2.0.1 (RUSTSEC-2025-0141) is in the lockfile but not compiled in.
Most clear with the upgrades in the other issues (matrix-sdk 0.19, a newer `davey`). `rustls-pemfile` needs `irc` to move to `rustls-pki-types`, which may mean a patch upstream.
Salastil
added this to the v1.0 milestone 2026-10-02 19:03:40 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two
unsafeblocks (both sound libc calls inmain.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate inCargo.lock, and each one traced to whether it is actually compiled in.No known vulnerability in any of these, but nobody will fix one if it is found:
instant0.1.13parking_lot(old),openmls,daveypaste1.0.15fs-mistrust,tor-config) - build time onlyproc-macro-error22.0.1aquamarine) - build time onlyrustls-pemfile2.2.0ircbitmaps3.2.1imbl(see the matrix-sdk issue)bincode2.0.1 (RUSTSEC-2025-0141) is in the lockfile but not compiled in.Most clear with the upgrades in the other issues (matrix-sdk 0.19, a newer
davey).rustls-pemfileneedsircto move torustls-pki-types, which may mean a patch upstream.