Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency cargo 0.73.1 has a vulnerable dependency #23

Closed
nspin opened this issue Oct 3, 2023 · 1 comment
Closed

Dependency cargo 0.73.1 has a vulnerable dependency #23

nspin opened this issue Oct 3, 2023 · 1 comment

Comments

@nspin
Copy link
Member

nspin commented Oct 3, 2023

cargo-audit output:

    Scanning Cargo.lock for vulnerabilities (530 crate dependencies)
Crate:     gix-transport
Version:   0.32.0
Title:     gix-transport code execution vulnerability
Date:      2023-09-23
ID:        RUSTSEC-2023-0064
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0064
Solution:  Upgrade to >=0.36.1
Dependency tree:
gix-transport 0.32.0
├── gix-protocol 0.33.2
│   └── gix 0.45.1
│       └── cargo 0.73.1
│           └── cargo-helpers 0.1.0
└── gix 0.45.1

error: 1 vulnerability found!

This dependency has been bumped upstream (rust-lang/cargo#12731), but that fix has not yet made it into a version of the cargo crate on crates.io. When it does, we should bump the version of the cargo crate used in this project.

Note that the cargo-helpers crate is not exposed to users of this project, and is also not affected by this vulnerability. Regardless, we should bump its cargo crate dependency version as soon as a newer one is available.

@nspin
Copy link
Member Author

nspin commented Oct 24, 2023

Vulnerable dependency is no longer part of the project's dependency graph after #37

@nspin nspin closed this as completed Oct 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant