Security issue

[Tockra]

Hi,

I got security warnings from github for a long time.
Now I wanted to fix it and I updated reqwest to the newest version.
After using cargo audit I still get the following security warnings:

Crate:     futures-task
Version:   0.3.1
Title:     futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Date:      2020-09-04
ID:        RUSTSEC-2020-0060
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0060
Solution:  Upgrade to >=0.3.6
Dependency tree:
futures-task 0.3.1
└── futures-util 0.3.1
    ├── reqwest 0.11.14
    │   └── hoster_tools 1.0.0
    ├── hyper 0.14.24
    │   ├── reqwest 0.11.14
    │   └── hyper-tls 0.5.0
    │       └── reqwest 0.11.14
    └── h2 0.3.15
        ├── reqwest 0.11.14
        └── hyper 0.14.24

Crate:     futures-task
Version:   0.3.1
Title:     futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
Date:      2020-05-03
ID:        RUSTSEC-2020-0061
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0061
Solution:  Upgrade to >=0.3.5

Crate:     futures-util
Version:   0.3.1
Title:     Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
Date:      2020-01-24
ID:        RUSTSEC-2020-0062
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0062
Solution:  Upgrade to >=0.3.2
Dependency tree:
futures-util 0.3.1
├── reqwest 0.11.14
│   └── hoster_tools 1.0.0
├── hyper 0.14.24
│   ├── reqwest 0.11.14
│   └── hyper-tls 0.5.0
│       └── reqwest 0.11.14
└── h2 0.3.15
    ├── reqwest 0.11.14
    └── hyper 0.14.24

I think its a issue in the current version of reqwest. Is there a possibility to fix it?

T

[seanmonstar]

You should be able to run cargo update futures-task or cargo update futures-util or any other dependency, and it will update it. Even cargo update should just update them all, but you can specify if you want.

[Tockra]

Ah thank you. I was a little bit confused, because the cargo.toml of the reqwest project contains version "0.3" (futures-util). So I thought it need to be updated to get version 0.3.2