Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable component is the Rust crate atty. Per the GitHub Security Advisory at https://github.com/advisories/GHSA-g98v-hv3f-hcfr (atty potential unaligned read), atty is listed as affected with no published fixed version (vulnerable range <=0.2.14). atty is unmaintained upstream and the advisory declares no firstPatchedVersion; the entire published version range is flagged. Without an upstream patched release of atty, this issue cannot be closed by routine dependency-bump automation. A pending-upstream-fix advisory event is justified: the issue should reflect that we are awaiting either upstream atty to publish a maintained release, or a package-level migration to a maintained alternative such as is-terminal.
Status