Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix clippy warnings + uprade some audited deps #115

Merged
merged 10 commits into from
Oct 9, 2023

Conversation

fenollp
Copy link
Collaborator

@fenollp fenollp commented Aug 22, 2023

Note: some audited deps are not simple to upgrade (and weren't). This needs further work:

λ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 561 security advisories (from /home/pete/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (134 crate dependencies)
Crate:     rustc-serialize
Version:   0.3.24
Title:     Stack overflow in rustc_serialize when parsing deeply nested JSON
Date:      2022-01-01
ID:        RUSTSEC-2022-0004
URL:       https://rustsec.org/advisories/RUSTSEC-2022-0004
Solution:  No fixed upgrade is available!
Dependency tree:
rustc-serialize 0.3.24
├── num-rational 0.1.42
│   └── num 0.1.42
│       └── stopwatch 0.0.7
│           └── libremarkable 0.6.0
├── num-complex 0.1.43
│   └── num 0.1.42
└── num-bigint 0.1.44
    ├── num-rational 0.1.42
    └── num 0.1.42

Crate:     time
Version:   0.1.45
Title:     Potential segfault in the time crate
Date:      2020-11-18
ID:        RUSTSEC-2020-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0071
Severity:  6.2 (medium)
Solution:  Upgrade to >=0.2.23
Dependency tree:
time 0.1.45
└── chrono 0.4.26
    └── libremarkable 0.6.0

Crate:     rusttype
Version:   0.9.3
Warning:   unmaintained
Title:     rusttype is Unmaintained
Date:      2021-04-01
ID:        RUSTSEC-2021-0140
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0140
Dependency tree:
rusttype 0.9.3
└── libremarkable 0.6.0

error: 2 vulnerabilities found!
warning: 1 allowed warning found

Also: shouldn't we be setting dependency versions with broader constraints than an exact version number? e.g: "1.0" or "1"? Lib consumers then should be able to upgrade their own deps before eventually making PRs against this repo

Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
Copy link
Collaborator

@LinusCDE LinusCDE left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making and mentioning it. Should have been merged a while ago ig. Just checked that current rust was still happy and fixed the new clippy lint error.

Lgtm!

Signed-off-by: Pierre Fenoll <pierrefenoll@gmail.com>
@LinusCDE
Copy link
Collaborator

LinusCDE commented Oct 6, 2023

If no issues are raised in the next few days, lets just merge this ig.

Copy link
Collaborator

@bkirwi bkirwi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are great!

(I should have more time to stay on top of changes like these soon, but also don't feel the need to block on me for them!)

@fenollp fenollp merged commit e550d69 into canselcik:master Oct 9, 2023
7 checks passed
@fenollp fenollp deleted the updates branch October 9, 2023 08:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants