-
Notifications
You must be signed in to change notification settings - Fork 212
Commit 527689c
committed
Update vulnerable dependencies
This brings the number of vulnerable dependencies down from 8 to 1.
The remaining vulnerability can't be easily fixed:
```
> cargo tree -i generic-array:0.12.3
generic-array v0.12.3
├── block-buffer v0.7.3
│ └── sha-1 v0.8.2
│ [build-dependencies]
│ └── pest_meta v2.1.3
│ └── pest_generator v2.1.3
│ └── pest_derive v2.1.0 (proc-macro)
│ ├── comrak v0.9.1
│ │ └── docs-rs v0.6.0 (/home/joshua/src/rust/docs.rs)
│ └── tera v1.5.0
│ └── docs-rs v0.6.0 (/home/joshua/src/rust/docs.rs)
└── digest v0.8.1
└── sha-1 v0.8.2 (*)
```
`pest` or `sha-1` will need to release a new version that depends on a
fixed version of generic-array.
Here's a list of all changes:
```
$ cat updates.txt
comrak
futures-core
futures-util
generic-array:0.12.3
generic-array:0.14.3
hyper:0.10.16
hyper:0.13.6
pest_derive
pest_generator
pest_meta
sha-1
smallvec:0.6.13
smallvec:1.4.0
time:0.2.16
$ xargs -n1 cargo update -p < updates.txt
Updating arc-swap v0.4.6 -> v0.4.8
Updating futures-core v0.3.5 -> v0.3.13
Updating futures-channel v0.3.5 -> v0.3.13
Updating futures-io v0.3.5 -> v0.3.13
Updating futures-macro v0.3.5 -> v0.3.13
Updating futures-sink v0.3.5 -> v0.3.13
Updating futures-task v0.3.5 -> v0.3.13
Updating futures-util v0.3.5 -> v0.3.13
Adding pin-project-lite v0.2.4
Updating proc-macro-hack v0.5.15 -> v0.5.19
Updating generic-array v0.14.3 -> v0.14.4
Adding cfg-if v1.0.0
Adding httpdate v0.3.2
Updating hyper v0.13.6 -> v0.13.10
Adding pin-project v1.0.5
Adding pin-project-internal v1.0.5
Updating proc-macro2 v1.0.13 -> v1.0.24
Updating syn v1.0.22 -> v1.0.60
Adding tracing v0.1.25
Adding tracing-core v0.1.17
Updating smallvec v0.6.13 -> v0.6.14
Updating smallvec v1.4.0 -> v1.6.1
Adding const_fn v0.4.5
Updating time v0.2.16 -> v0.2.25
```
Here are the previous warnings:
```
> cargo audit
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
Loaded 249 security advisories (from /home/joshua/.local/lib/cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (417 crate dependencies)
error: Vulnerable crates found!
ID: RUSTSEC-2020-0091
Crate: arc-swap
Version: 0.4.6
Date: 2020-12-10
URL: https://rustsec.org/advisories/RUSTSEC-2020-0091
Title: Dangling reference in `access::Map` with Constant
Solution: upgrade to >= 1.1.0 OR >= 0.4.8
Dependency tree:
arc-swap 0.4.6
├── signal-hook-registry 1.2.0
│ └── tokio 0.2.22
│ ├── tokio-util 0.3.1
│ │ ├── tokio-postgres 0.5.5
│ │ │ └── postgres 0.17.5
│ │ │ ├── schemamama_postgres 0.3.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ ├── r2d2_postgres 0.16.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ └── docs-rs 0.6.0
│ │ └── h2 0.2.5
│ │ └── hyper 0.13.6
│ ├── tokio-tls 0.3.1
│ │ ├── reqwest 0.10.6
│ │ │ ├── rustwide 0.11.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ └── docs-rs 0.6.0
│ │ └── hyper-tls 0.4.1
│ │ ├── rusoto_core 0.45.0
│ │ │ ├── rusoto_s3 0.45.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ └── docs-rs 0.6.0
│ │ └── reqwest 0.10.6
│ ├── tokio-postgres 0.5.5
│ ├── rustwide 0.11.0
│ ├── rusoto_signature 0.45.0
│ │ └── rusoto_core 0.45.0
│ ├── rusoto_credential 0.45.0
│ │ ├── rusoto_signature 0.45.0
│ │ ├── rusoto_core 0.45.0
│ │ └── docs-rs 0.6.0
│ ├── rusoto_core 0.45.0
│ ├── reqwest 0.10.6
│ ├── postgres 0.17.5
│ ├── hyper-tls 0.4.1
│ ├── hyper 0.13.6
│ ├── h2 0.2.5
│ └── docs-rs 0.6.0
└── docs-rs 0.6.0
ID: RUSTSEC-2020-0060
Crate: futures-task
Version: 0.3.5
Date: 2020-09-04
URL: https://rustsec.org/advisories/RUSTSEC-2020-0060
Title: futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Solution: upgrade to >= 0.3.6
Dependency tree:
futures-task 0.3.5
├── futures-util 0.3.5
│ ├── rustwide 0.11.0
│ │ └── docs-rs 0.6.0
│ ├── reqwest 0.10.6
│ │ ├── rustwide 0.11.0
│ │ └── docs-rs 0.6.0
│ ├── hyper 0.13.6
│ ├── h2 0.2.5
│ │ └── hyper 0.13.6
│ ├── futures-executor 0.3.5
│ │ └── futures 0.3.5
│ │ ├── tokio-postgres 0.5.5
│ │ │ └── postgres 0.17.5
│ │ │ ├── schemamama_postgres 0.3.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ ├── r2d2_postgres 0.16.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ └── docs-rs 0.6.0
│ │ ├── rusoto_signature 0.45.0
│ │ │ └── rusoto_core 0.45.0
│ │ │ ├── rusoto_s3 0.45.0
│ │ │ │ └── docs-rs 0.6.0
│ │ │ └── docs-rs 0.6.0
│ │ ├── rusoto_s3 0.45.0
│ │ ├── rusoto_credential 0.45.0
│ │ │ ├── rusoto_signature 0.45.0
│ │ │ ├── rusoto_core 0.45.0
│ │ │ └── docs-rs 0.6.0
│ │ ├── rusoto_core 0.45.0
│ │ └── postgres 0.17.5
│ ├── futures 0.3.5
│ └── docs-rs 0.6.0
├── futures-executor 0.3.5
└── futures 0.3.5
ID: RUSTSEC-2020-0059
Crate: futures-util
Version: 0.3.5
Date: 2020-10-22
URL: https://rustsec.org/advisories/RUSTSEC-2020-0059
Title: MutexGuard::map can cause a data race in safe code
Solution: upgrade to >= 0.3.7
Dependency tree:
futures-util 0.3.5
├── rustwide 0.11.0
│ └── docs-rs 0.6.0
├── reqwest 0.10.6
│ ├── rustwide 0.11.0
│ └── docs-rs 0.6.0
├── hyper 0.13.6
├── h2 0.2.5
│ └── hyper 0.13.6
├── futures-executor 0.3.5
│ └── futures 0.3.5
│ ├── tokio-postgres 0.5.5
│ │ └── postgres 0.17.5
│ │ ├── schemamama_postgres 0.3.0
│ │ │ └── docs-rs 0.6.0
│ │ ├── r2d2_postgres 0.16.0
│ │ │ └── docs-rs 0.6.0
│ │ └── docs-rs 0.6.0
│ ├── rusoto_signature 0.45.0
│ │ └── rusoto_core 0.45.0
│ │ ├── rusoto_s3 0.45.0
│ │ │ └── docs-rs 0.6.0
│ │ └── docs-rs 0.6.0
│ ├── rusoto_s3 0.45.0
│ ├── rusoto_credential 0.45.0
│ │ ├── rusoto_signature 0.45.0
│ │ ├── rusoto_core 0.45.0
│ │ └── docs-rs 0.6.0
│ ├── rusoto_core 0.45.0
│ └── postgres 0.17.5
├── futures 0.3.5
└── docs-rs 0.6.0
ID: RUSTSEC-2020-0146
Crate: generic-array
Version: 0.12.3
Date: 2020-04-09
URL: https://rustsec.org/advisories/RUSTSEC-2020-0146
Title: arr! macro erases lifetimes
Solution: upgrade to >= 0.14.0
Dependency tree:
generic-array 0.12.3
ID: RUSTSEC-2021-0020
Crate: hyper
Version: 0.13.6
Date: 2021-02-05
URL: https://rustsec.org/advisories/RUSTSEC-2021-0020
Title: Multiple Transfer-Encoding headers misinterprets request payload
Solution: upgrade to >= 0.14.3 OR ^0.13.10
Dependency tree:
hyper 0.13.6
ID: RUSTSEC-2021-0003
Crate: smallvec
Version: 0.6.13
Date: 2021-01-08
URL: https://rustsec.org/advisories/RUSTSEC-2021-0003
Title: Buffer overflow in SmallVec::insert_many
Solution: upgrade to >= 0.6.14, < 1.0.0 OR >= 1.6.1
Dependency tree:
smallvec 0.6.13
ID: RUSTSEC-2021-0003
Crate: smallvec
Version: 1.4.0
Date: 2021-01-08
URL: https://rustsec.org/advisories/RUSTSEC-2021-0003
Title: Buffer overflow in SmallVec::insert_many
Solution: upgrade to >= 0.6.14, < 1.0.0 OR >= 1.6.1
Dependency tree:
smallvec 1.4.0
ID: RUSTSEC-2020-0071
Crate: time
Version: 0.2.16
Date: 2020-11-18
URL: https://rustsec.org/advisories/RUSTSEC-2020-0071
Title: Potential segfault in the time crate
Solution: upgrade to >= 0.2.23
Dependency tree:
time 0.2.16
```1 parent 5389b57 commit 527689cCopy full SHA for 527689c
1 file changed
+151
-89
lines changed
0 commit comments