Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problem: cargo audit warnings #341

Open
tomtau opened this issue Jun 16, 2022 · 1 comment
Open

Problem: cargo audit warnings #341

tomtau opened this issue Jun 16, 2022 · 1 comment

Comments

@tomtau
Copy link

tomtau commented Jun 16, 2022

Describe the bug
Running cargo audit found three unmaintained dependencies: failure, net2 and serde_cbor.

Running cargo audit found four vulnerable dependencies:

  1. RUSTSEC-2021-0119 in nix 0.20.0 – requires upgrade to >=0.23.0
  2. RUSTSEC-2022-0013 in regex 1.5.4 – requires upgrade to >=1.5.5
  3. RUSTSEC-2020-0071 in time 0.1.43 – requires update to >=0.2.23
  4. RUSTSEC-2021-0124 in tokio 0.2.25 – requires upgrade to >=1.13.1

To Reproduce
Steps to reproduce the behavior:

  1. Run cargo audit

Expected behavior
No unmaintained dependencies shown.
No vulnerable dependencies shown.

Desktop:

  • OS: Ubuntu
  • Version 22.04
@tomtau
Copy link
Author

tomtau commented Jun 16, 2022

note that most of them come from the SGX runner-related dependencies: https://github.com/crypto-com/tmkms-light/blob/main/.github/workflows/tmkms.yml#L55 and would need to be fixed upstream in https://github.com/fortanix/rust-sgx

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant