alixinne / hyperion.rs

Rust implementation of the Hyperion Ambient Lighting software
MIT License
10 stars 1 forks source link

fix(deps): update rust crate flatbuffers to v22 [security] #26

Closed renovate[bot] closed 9 months ago

renovate[bot] commented 9 months ago

Mend Renovate

This PR contains the following updates:

Package Type Update Change
flatbuffers (source) dependencies major 2.1 -> 22.9

GitHub Vulnerability Alerts

GHSA-3jch-9qgp-4844

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details.

All users that use generated code by flatbuffers compiler are recommended to:

  1. not expose flatbuffer generated code as part of their public APIs
  2. audit their code and look for any usage of follow, push, or any method that uses them (e.g. self_follow).
  3. Carefuly go through the crates' documentation to understand which "safe" APIs are not intended to be used.

Release Notes

google/flatbuffers (flatbuffers) ### [`v22.9.29`](https://togithub.com/google/flatbuffers/blob/HEAD/CHANGELOG.md#22929-Sept-29-2022) - Rust soundness fixes to avoid the crate from bing labelled unsafe ([#​7518](https://togithub.com/google/flatbuffers/issues/7518)).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 9 months ago

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

The artifact failure details are included below:

File name: Cargo.lock
Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package flatbuffers@2.1.2 --precise 22.9.29
error: package ID specification `flatbuffers@2.1.2` did not match any packages
Did you mean one of these?

  flatbuffers@22.12.6