chore(deps): replace users crate as per rustsec advisory #86
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
The users crate is unmaintained since 2020. This made the rustsec team to file two security issues for the crate:
users
crate is unmaintained: https://github.com/rustsec/advisory-db/blob/main/crates/users/RUSTSEC-2023-0040.mdUnaligned read of
*const *const c_char
pointer: https://github.com/rustsec/advisory-db/blob/main/crates/users/RUSTSEC-2023-0059.mdThe security issues recommend to replace the
users
dependency with eitheruzers
crate (a maintained fork of theusers
crate) or to move tosysinfo
crate.This Rust security advisory issues translate into dependabot security alerts like the following:
Proposed solution
The
uzers
fork, thanks to a PThorpe92 patch (rustadopt/uzers-rs#8), solved the security issue. This patch was included in the latest release, v0.11.3.Therefore, replacing the
users
crate with theuzers
(>= v0.11.3) crate should solve the security issue reported by the rustec team (and keep dependabot happy).