Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix various cargo audit errors #5206

Closed
wants to merge 1 commit into from
Closed

Fix various cargo audit errors #5206

wants to merge 1 commit into from

Conversation

Pi-Cla
Copy link
Contributor

@Pi-Cla Pi-Cla commented Mar 23, 2024

Compare the cargo audit output before and after. (The remaining errors can't be fixed until the authors of these dependencies update their own dependencies and release a new version)

I ran cargo update which on it's own fixed RUSTSEC-2024-0019 and RUSTSEC-2024-0020 which are serious vulnerabilities.

I bumped criterion to 0.5 so that we stop transitively depending atty which is unmaintained and has an unmerged fix for its vulnerability.

I bumped k9 to 0.12 so that we stop transitively depending on term_size which is unmaintained.

Finally I bumped starship-battery to 0.8 so that we stop transitively depending on mach which is also unmaintained.

@Pi-Cla
Copy link
Contributor Author

Pi-Cla commented Mar 23, 2024

See ebarnard/rust-plist#134 for a PR waiting to be merged which would allow us to no longer transitively depend on the unmaintained safemem crate

@Pi-Cla
Copy link
Contributor Author

Pi-Cla commented Mar 23, 2024

See losfair/sqlite-cache#5 for requesting a new release of sqlite-cache be uploaded to crates.io so that we are no longer vulnerable to RUSTSEC-2022-0090

@wez
Copy link
Owner

wez commented Mar 25, 2024

Thanks for this!

Please undo the whitespace changes to files that have no functional effect. They make it harder to merge (and importantly: revert later if needed!) independent commits.

I also want to note that that none of the rustsec advisories you listed are practical vulnerabilities to wezterm itself; we don't use any of the affected functionality.

@Pi-Cla
Copy link
Contributor Author

Pi-Cla commented Mar 25, 2024

@wez Whitespace changes have been removed

@wez wez closed this in ee61e61 May 5, 2024
@wez
Copy link
Owner

wez commented May 5, 2024

Thanks; I rebased this and pushed it to main!

saep pushed a commit to saep/wezterm that referenced this pull request Jul 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants