Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): replace users crate as per rustsec advisory #86

Merged
merged 1 commit into from
Mar 5, 2024

Conversation

LNSD
Copy link
Contributor

@LNSD LNSD commented Mar 5, 2024

Context

The users crate is unmaintained since 2020. This made the rustsec team to file two security issues for the crate:

The security issues recommend to replace the users dependency with either uzers crate (a maintained fork of the users crate) or to move to sysinfo crate.

This Rust security advisory issues translate into dependabot security alerts like the following:

image

Proposed solution

The uzers fork, thanks to a PThorpe92 patch (rustadopt/uzers-rs#8), solved the security issue. This patch was included in the latest release, v0.11.3.

Therefore, replacing the users crate with the uzers (>= v0.11.3) crate should solve the security issue reported by the rustec team (and keep dependabot happy).

@@ -27,7 +27,7 @@ num_cpus = { version = "1.13", optional = true }
which = { version = "5.0", optional = true }

[target.'cfg(not(target_os = "windows"))'.dependencies]
users = { version = "0.11", optional = true }
uzers = { version = "0.11.3", optional = true }
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Specifying the "patch" version makes cargo to resolve the uzers dependency with >= v0.11.3 constraint.

@LNSD
Copy link
Contributor Author

LNSD commented Mar 5, 2024

The Lint/lint check is failing again due to being unable to check PR changes coming from a fork. The failure is unrelated to the PR changes.

@yanganto yanganto merged commit 6b7f430 into yanganto:main Mar 5, 2024
1 of 2 checks passed
@yanganto
Copy link
Owner

yanganto commented Mar 5, 2024

Many thanks ❤️

@LNSD LNSD deleted the replace-users-crate branch March 5, 2024 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants