RUSTSEC-2025-0023: Broadcast channel calls clone in parallel, but does not require `Sync`

| Details | |
| --- | --- |
| Package | `tokio` |
| Version | `1.42.0` |
| Warning | unsound |
| URL | https://github.com/tokio-rs/tokio/pull/7232 |
| Patched Versions | >=1.38.2, <1.39.0 OR >=1.42.1, <1.43.0 OR >=1.43.1, <1.44.0 OR >=1.44.2 |
| Unaffected Versions | <0.2.5 |
| Aliases | [GHSA-rr8g-9fpq-6wmg](https://github.com/advisories/GHSA-rr8g-9fpq-6wmg) |

The broadcast channel internally calls `clone` on the stored value when
receiving it, and only requires `T:Send`. This means that using the broadcast
channel with values that are `Send` but not `Sync` can trigger unsoundness if
the `clone` implementation makes use of the value being `!Sync`.

Thank you to Austin Bonander for finding and reporting this issue.