rustsec
`interment`s `LocalIntern` type is unsound
The last update (0.6.0) of interment notes in its changelog that it removed LocalIntern because it can be used to cause use-after-free errors.
https://github.com/droundy/internment/blob/9270a4d05c6c18f89e7ecfb2ad3fe52250f6385f/CHANGELOG.md
The type is removed in 0.6.0 but present on older versions.
This crate has 639,063 downloads of all time, 3k downloads a day with majority of them < 0.6.0
I sent the maintainer a friendly offer to help them to get their users up to sound version. Let's see if I get a response.
Most downloads are on the unsound versions so I guess people have specified 0.5 or equivalent on their manifests and because the 0.6.0 had breaking ABI change that removed LocalIntern that is semver incompatible thus cargo keeps picking up 0.5.
I asked the maintainer if they are open to yank the old unsound versions and whether they would agree for us to put an informational / unsound advisory out to get the people to update in combination. Let's see.
Thanks for the heads up!
