day-piece-webview 0.4.4

Done dynamic on Linux job 280438 crates.io SBOM Findings (VEX)

high severity downloader_pattern in build_script code: https://www.nuget.org/api/v2/package/Microsoft.Web.WebView2/{VERSION} at build.rs:176 with std::process::Command::new at build.rs:191

high

False positive. A person reviewed this verdict and found the crate benign. The evidence below is what the analysis saw.

Evidence

Points	Signal	Where	What
30	static:downloader_pattern static · day-piece-webview	build.rs:176	high severity downloader_pattern in build_script code: https://www.nuget.org/api/v2/package/Microsoft.Web.WebView2/{VERSION} at build.rs:176 with std::process::Command::new at build.rs:191
10	build_script_added diff · day-piece-webview		A build script was added since 0.0.1.
10	new_high_finding diff · day-piece-webview	build.rs:176	New since 0.0.1: downloader_pattern

3 without points

Signal	Where	What
static:build_script static · day-piece-webview	build.rs	low severity build_script in build_script code: build.rs
static:process_spawn static · day-piece-webview	build.rs:191	medium severity process_spawn in build_script code (3 places): std::process::Command::new
static:url_literal static · day-piece-webview	build.rs:176	low severity url_literal in build_script code (35 places): https://www.nuget.org/api/v2/package/Microsoft.Web.WebView2/{VERSION}

Behavior

New since the previous version

static:downloader_pattern static:process_spawn

Profile

static:downloader_pattern static:process_spawn

Static findings

high downloader_pattern build_script 1

https://www.nuget.org/api/v2/package/Microsoft.Web.WebView2/{VERSION} at build.rs:176 with std::process::Command::new at build.rs:191 build.rs:176

medium process_spawn build_script 3

std::process::Command::new build.rs:191 build.rs:205 build.rs:213

low foreign_functions library 4

extern block src/lib-gtk-macos.rs:14 src/lib-qt.rs:17 src/lib-xaml.rs:18 src/resources_arkui.rs:13

low foreign_functions test 3

extern block tests/linux/gl-context.rs:11 tests/linux/gl-context.rs:17 tests/linux/gl-context.rs:39

low build_script build_script 1

build.rs build.rs

low url_literal build_script 1

https://www.nuget.org/api/v2/package/Microsoft.Web.WebView2/{VERSION} build.rs:176

info url_literal library 34

file:///android_asset/{}/{} src/lib-android.rs:81
file:///android_asset/{}/ src/lib-android.rs:82
file://{}/ src/lib-gtk.rs:268
(() => {\u{a} const click = e => {\u{a} const a = e.composedPath().find(n => n?.tagName === 'A' && n.href);\u{a} if (!a || !(e.metaKey || e.ctrlKey || e.button === 1)) return;\u{a} e.prevent… src/lib.rs:951
https://news.example.com/story src/lib.rs:1582
https://news.example.co.uk/ src/lib.rs:1586
https://project.github.io/ src/lib.rs:1590
https://unrelated.test/ src/lib.rs:1594
https://example.com/ src/lib.rs:1598 src/lib.rs:1606 src/lib.rs:1610
http://example.com/ src/lib.rs:1602
https://news.example.com/account/page src/lib.rs:1617
http://news.example.com/account src/lib.rs:1623
https://evil-example.com/account src/lib.rs:1629
https://news.example.com/accounting src/lib.rs:1635
https://news.example.com/ src/lib.rs:1641
file:///account src/lib.rs:1647
https://EXAMPLE.com/ src/lib.rs:1653
file:///tmp/fixture.html src/lib.rs:1776
https://example.test/story src/lib.rs:1779 src/lib.rs:1786 src/lib.rs:1793
file:///tmp/fixture.html#note src/lib.rs:1800
file:///tmp/next.html src/lib.rs:1807
https://example.test/frame src/lib.rs:1814
https://example.test/story?a=1#x src/lib.rs:1821
https://example.test/story?a=2 src/lib.rs:1822
day-resource://p{}/ src/resources.rs:100 src/resources.rs:106
http://day-resource.p{}/ src/resources.rs:102
https://day-resource.invalid/{}/ src/resources.rs:104
https://elsewhere.invalid/ src/resources.rs:553
https://day-resource.invalid/ src/resources_arkui.rs:84

info unsafe_code library 10

2 unsafe blocks, functions or impls src/browser.rs:182
4 unsafe blocks, functions or impls src/lib-gtk-macos.rs:60 src/storage_apple.rs:11
9 unsafe blocks, functions or impls src/lib-qt.rs:52 src/lib-xaml.rs:56
14 unsafe blocks, functions or impls src/lib-uikit.rs:174
16 unsafe blocks, functions or impls src/macos_web.rs:186
15 unsafe blocks, functions or impls src/resources.rs:286
1 unsafe blocks, functions or impls src/resources_apple.rs:64
10 unsafe blocks, functions or impls src/resources_arkui.rs:61

info unsafe_code test 1

1 unsafe blocks, functions or impls tests/linux/gl-context.rs:72

Run: full

succeeded

The full build covers everything the earlier cargo check run did, so only the full run is shown.

Ended: agent reported the end
Guest: exit code 0
Run time: 1 min 25 s
VM restore: 76 ms
Payload: 4860 files, 132.4 MiB
Files opened: 17644

Processes 290

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number. Hide the 263 compiler processes (rustc, C toolchain)

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	build --locked --offline	5 ms	1 min 25 s	0
└rustc /usr/local/bin/rustc ×34	--crate-name build_script_build --edition=2021 /cw/vendor/proc-macro2-1.0.107/build.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C embed-bitcode=no --cfg feature="default" --cfg feature="proc-macro" --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values("default", "nightly", "proc-macro", "span-locations")) -C metadata=a3dc8fb24392fcd4 -C extra-filename=-a411f7480bd0f42c --out-dir /work/target/debug/build/proc-macro2-a411f7480bd0f42c -L dependency=/work/target/debug/deps --cap-lints allow	246 ms	684 ms	0
└toolchain /usr/bin/cc	-m64 /work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustc0F1AVY/symbols.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.build_script_build.dd8d7f624ad1d48e-cgu.0.rcgu.o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c.cnca5igddme2fkrf01fktrtaw.rcgu.o -Wl,--as-needed -Wl,-Bstatic /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-64f5f36fb0927694.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-549498e8b2e4d924.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-7ff85ea729a864ff.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-0e3477fb2664a277.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-09755979c57b7e64.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-9a1fede77fbbf2f0.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-360da4ba13154744.rlib /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib/lib	754 ms	173 ms	0
└toolchain /usr/libexec/gcc/x86_64-linux-gnu/14/collect2	-plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc5DcZYf.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -fuse-ld=lld -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustc0F1AVY/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L	776 ms	151 ms	0
└toolchain /usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-lld	-flavor gnu -plugin /usr/libexec/gcc/x86_64-linux-gnu/14/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/14/lto-wrapper -plugin-opt=-fresolution=/tmp/cc5DcZYf.res --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -o /work/target/debug/build/proc-macro2-a411f7480bd0f42c/build_script_build-a411f7480bd0f42c /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/14/crtbeginS.o -L/work/target/debug/build/proc-macro2-a411f7480bd0f42c/rustc0F1AVY/raw-dylibs -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/lib -L/usr/local/lib/rustlib/x86_64-unknown-linux-gnu/bin/gcc-ld -L/usr/lib/gcc/x86_64-linux-gnu/14 -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/14/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_6	784 ms	142 ms	0
└build_script proc-macro2		934 ms	80 ms	0
└rustc /usr/local/bin/rustc ×3	--version	936 ms	6 ms	0
└rustc /usr/local/bin/rustc	--cfg=procmacro2_build_probe --edition=2021 --crate-name=proc_macro2 --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/proc-macro2-4f3f927bd5485a92/out/probe src/probe/proc_macro_span.rs --target x86_64-unknown-linux-gnu	943 ms	32 ms	256
└rustc /usr/local/bin/rustc ×111	--crate-name unicode_ident --edition=2021 /cw/vendor/unicode-ident-1.0.27/src/lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata,link -C embed-bitcode=no --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=3bb98f7b2f589c61 -C extra-filename=-86dff03eb05ec8a5 --out-dir /work/target/debug/deps -L dependency=/work/target/debug/deps --cap-lints allow	1.0 s	58 ms	0
└build_script quote		1.1 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	1.1 s	7 ms	0
└build_script icu_locale_fallback_data		11.6 s	1 ms	0
└build_script icu_properties_data		12.8 s	1 ms	0
└build_script libm		12.8 s	1 ms	0
└build_script icu_normalizer_data		13.3 s	1 ms	0
└build_script thiserror		13.3 s	29 ms	0
└rustc /usr/local/bin/rustc	--edition=2018 --crate-name=thiserror --crate-type=lib --cap-lints=allow --emit=dep-info,metadata --out-dir /work/target/debug/build/thiserror-2a2ace9117c7add0/out/probe build/probe.rs --target x86_64-unknown-linux-gnu	13.3 s	18 ms	256
└rustc /usr/local/bin/rustc	--version	13.3 s	7 ms	0
└build_script serde_core		19.2 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	19.2 s	7 ms	0
└build_script icu_calendar_data		19.2 s	1 ms	0
└build_script icu_decimal_data		20.6 s	1 ms	0
└build_script libc		20.6 s	11 ms	0
└rustc /usr/local/bin/rustc	--version	20.6 s	8 ms	0
└build_script icu_plurals_data		20.6 s	1 ms	0
└build_script icu_time_data		20.6 s	1 ms	0
└build_script icu_collator_data		24.2 s	2 ms	0
└build_script icu_segmenter_data		24.4 s	1 ms	0
└build_script icu_casemap_data		24.4 s	1 ms	0
└build_script icu_datetime_data		26.3 s	2 ms	0
└build_script slotmap		27.2 s	40 ms	0
└rustc /usr/local/bin/rustc ×3	--verbose --version	27.2 s	8 ms	0
└build_script linkme-impl		28.1 s	9 ms	0
└rustc /usr/local/bin/rustc	--version	28.1 s	7 ms	0
└build_script serde_core		33.4 s	13 ms	0
└rustc /usr/local/bin/rustc	--version	33.4 s	11 ms	0
└build_script linkme		35.8 s	2 ms	0
└build_script day-localization		35.9 s	3 ms	0
└build_script zmij		51.1 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	51.1 s	8 ms	0
└build_script serde		58.4 s	10 ms	0
└rustc /usr/local/bin/rustc	--version	58.4 s	8 ms	0
└build_script serde_json		58.4 s	3 ms	0
└build_script day-piece-webview		1 min 20 s	5 ms	0

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 1189
Directories: 269
Size: 762.8 MiB
Compiled units: 230
Scan: stopped at a limit

Nothing outside the build areas.

Output

Standard error

   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.27
   Compiling quote v1.0.47
   Compiling syn v3.0.9
   Compiling synstructure v0.14.0
   Compiling zerofrom-derive v0.1.8
   Compiling zerofrom v0.1.8
   Compiling yoke-derive v0.8.4
   Compiling stable_deref_trait v1.2.1
   Compiling yoke v0.8.4
   Compiling displaydoc v0.2.7
   Compiling zerovec-derive v0.11.7
   Compiling zerovec v0.11.9
   Compiling tinystr v0.8.5
   Compiling either v1.19.0
   Compiling writeable v0.6.4
   Compiling litemap v0.8.3
   Compiling icu_locale_core v2.4.0
   Compiling potential_utf v0.1.6
   Compiling zerotrie v0.2.5
   Compiling icu_provider v2.4.0
   Compiling smallvec v1.16.4
   Compiling icu_locale_fallback_data v2.4.0
   Compiling utf8_iter v1.0.4
   Compiling icu_collections v2.4.0
   Compiling libm v0.2.16
   Compiling icu_properties_data v2.4.0
   Compiling icu_locale_fallback v2.4.0
   Compiling thiserror v2.0.21
   Compiling icu_normalizer_data v2.4.0
   Compiling thiserror-impl v2.0.21
   Compiling memchr v2.8.3
   Compiling icu_properties v2.4.0
   Compiling core_maths v0.1.1
   Compiling unic-langid-impl v0.9.6
   Compiling write16 v1.0.0
   Compiling icu_calendar_data v2.4.0
   Compiling serde_core v1.0.229
   Compiling utf16_iter v1.0.5
   Compiling icu_normalizer v2.4.0
   Compiling unic-langid v0.9.6
   Compiling fluent-syntax v0.12.0
   Compiling ryu v1.0.23
   Compiling icu_time_data v2.4.0
   Compiling icu_plurals_data v2.4.0
   Compiling libc v0.2.191
   Compiling day-fonts v0.6.1
   Compiling icu_decimal_data v2.4.0
   Compiling version_check v0.9.5
   Compiling slotmap v1.1.1
   Compiling fixed_decimal v0.7.3
   Compiling calendrical_calculations v0.2.4
   Compiling icu_datetime_data v2.4.0
   Compiling ixdtf v0.6.7
   Compiling icu_casemap_data v2.4.0
   Compiling icu_segmenter_data v2.4.0
   Compiling rustc-hash v2.1.3
   Compiling icu_collator_data v2.4.0
   Compiling log v0.4.34
   Compiling type-map v0.5.1
   Compiling icu_calendar v2.4.0
   Compiling linkme-impl v0.3.37
   Compiling winnow v1.0.4
   Compiling toml_parser v1.1.5+spec-1.1.0
   Compiling icu_decimal v2.4.0
   Compiling memmap2 v0.9.12
   Compiling icu_plurals v2.4.0
   Compiling icu_time v2.4.0
   Compiling intl-memoizer v0.5.3
   Compiling toml_datetime v1.1.2+spec-1.1.0
   Compiling serde_spanned v1.1.2
   Compiling fluent-langneg v0.13.1
   Compiling intl_pluralrules v7.0.2
   Compiling icu_pattern v0.5.1
   Compiling day-geometry v0.6.1
   Compiling self_cell v1.3.0
   Compiling find-msvc-tools v0.1.15
   Compiling day-localization v0.6.1
   Compiling utf8parse v0.2.2
   Compiling linkme v0.3.37
   Compiling toml_writer v1.1.3+spec-1.1.0
   Compiling shlex v2.0.1
   Compiling cc v1.10.0
   Compiling toml v1.1.8+spec-1.1.0
   Compiling anstyle-parse v1.0.0
   Compiling fluent-bundle v0.16.0
   Compiling day-spec v0.6.1
   Compiling icu_datetime v2.4.0
   Compiling icu_collator v2.4.0
   Compiling icu_segmenter v2.4.0
   Compiling icu_casemap v2.4.0
   Compiling day-reactive v0.6.1
   Compiling is_terminal_polyfill v1.70.2
   Compiling anstyle v1.0.14
   Compiling anstyle-query v1.1.5
   Compiling day-async v0.6.1
   Compiling colorchoice v1.0.5
   Compiling zmij v1.0.23
   Compiling anstream v1.0.0
   Compiling day-build v0.6.1
   Compiling idna_adapter v1.2.2
   Compiling day-macros v0.6.1
   Compiling percent-encoding v2.3.2
   Compiling day-toolchain v0.6.1
   Compiling serde_json v1.0.154
   Compiling serde v1.0.229
   Compiling day-piece-webview v0.4.4
   Compiling form_urlencoded v1.2.2
   Compiling idna v1.1.0
   Compiling day-core v0.6.1
   Compiling serde_derive v1.0.229
   Compiling itoa v1.0.18
   Compiling psl-types v2.0.11
   Compiling psl v2.1.245
   Compiling day-pieces v0.6.1
   Compiling url v2.5.8
   Compiling day-bridge v0.6.1
   Compiling crateward-probe v0.0.0 (/cw/probe)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 25s

Timeline

When	From	To	Event	Worker
2026-10-26 18:28 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-26 18:28 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-26 18:33 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot0
2026-10-26 18:34 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot0
2026-10-26 18:34 UTC	DynamicallyAnalyzed	ReadyForSandbox	scored	analyzer-12816
2026-10-26 18:34 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot1
2026-10-26 18:36 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot1
2026-10-26 18:36 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-26 18:36 UTC	Scored	Done	finalized	analyzer-12816