Handling of pre-release versions

[hatzel]

I have the master version of cookies-rs as a dependency. Unfortunately cargo-audit lists '0.11.0-dev' as vulnerable even though it seems clearly >= 0.7.6.

Output

ID:	 RUSTSEC-2017-0005
Crate:	 cookie
Version: 0.11.0-dev
Date:	 2017-05-06
URL:	 https://github.com/alexcrichton/cookie-rs/pull/86
Title:	 Large cookie Max-Age values can cause a denial of service
Solution: upgrade to: < 0.6.0 OR ^0.6.2 OR >= 0.7.6

Desired Output

I am not sure. In this case the version is clearly not vulnerable but for the general case I am not too sure.

Take this example:

• Version of 0.6 of my-cool-crate is vulnerable.
• Vulnerability is noticed while 0.7-dev is out there
• Security advisory gets issued for 0.6, dev version gets silently fixed

In the end the user would not be warned, although you could argue a wrong advisory is at fault.

This matter probably needs some careful consideration.

Steps to reproduce

1. Add cookie = { git = "https://github.com/alexcrichton/cookie-rs.git" } to dependencies in Cargo.toml
2. Run cargo build and cargo audit

Or alternatively and in case cookies-rs changes its version just pull this repo and run cargo audit.

[tarcieri]

Other relevant issues for this:

dtolnay/semver#172
#17

[tarcieri]

This was fixed upstream in the RustSec crate in https://github.com/RustSec/rustsec-crate/pull/69 however to be fixed in cargo-audit that crate needs another release, and cargo-audit needs to be updated.