Bump crossbeam-queue to 0.3.5 to fix CVE-2022-23639
#5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hey @QuietMisdreavus, do you have some time to review this PR. I know that the crate is in maintenance mode but this PR fixes a CVE. |
|
Hey, just chiming in that I'm getting security alerts for this as well. I have taken a quick look through this PR and think the changes should be all good! @QuietMisdreavus , I hope you can find some time to take a look 🤞 |
|
Thanks for the PR! I've published version 1.0.1 with this change. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a fix for the CVE-2022-23639 which has been fixed in crossbeam-rs/crossbeam#781. I bumped the
crossbeam-queueto0.3.5and fixed the other deprecation warning from the Rust standard library.I am not very confident about my fix for the
compare_and_swapandcompare_exchange, if you want to take a look at something, please make sure that it is correct. I simply followed the small migration guide that is on the documentation. The tests are passing but, that is maybe not enough.I think it could be great and non-breaking to bump the patch very of this crate, what do you think?
Thank you for your time 🏖️