Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependencies to solve vulnerability #27

Merged
merged 1 commit into from
Dec 28, 2024

Conversation

JonathanBrouwer
Copy link
Contributor

The goal of this PR is to mitigate a vulnerability in a dependency of this crate
https://rustsec.org/advisories/RUSTSEC-2024-0421.html

@JonathanBrouwer JonathanBrouwer changed the title Update dependencies Update dependencies to solve vulnerability Dec 10, 2024
@santhosh-tekuri
Copy link
Owner

  • do rebase
  • update rustls version in cli/Cargo.toml

@JonathanBrouwer JonathanBrouwer force-pushed the main branch 3 times, most recently from ab98dd0 to 82f8fe1 Compare December 28, 2024 11:28
@JonathanBrouwer
Copy link
Contributor Author

I think it should be good now? @santhosh-tekuri

@santhosh-tekuri
Copy link
Owner

Cli module is not compiling. Check the logs. I guess you need to add 'ring' feature to rustls in feature module. Please compile locally and verify

@JonathanBrouwer
Copy link
Contributor Author

JonathanBrouwer commented Dec 28, 2024

Right, had to update ureq as well since it depends on an olddated rustls.
I ran cargo check on the main project but forgot that doesn't run it on the cli project :P

I'm crossing my fingers that everything is good now? @santhosh-tekuri

(Also not really used to a rebase-based workflow, I think the idea is that every individual commit should work right? Therefore I amended the commit, but that does mean that you lose your review progress)

@santhosh-tekuri
Copy link
Owner

Single commit is good as we are fixing same issue with mistakes. Seems the checks are passing.

@santhosh-tekuri
Copy link
Owner

Can you update ureq version in main cargo.toml also

@JonathanBrouwer
Copy link
Contributor Author

Done

@santhosh-tekuri
Copy link
Owner

FYI the commit message has to be modified to follow project convention:

scope: message

description

so the commit message will be

cargo/deps: mitigate vulnerabilities

- rustls: https://rustsec.org/advisories/RUSTSEC-2024-0336.html
- idna: https://rustsec.org/advisories/RUSTSEC-2024-0421.html

@santhosh-tekuri santhosh-tekuri merged commit 7c420fd into santhosh-tekuri:main Dec 28, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants