search

johnstonskj / rust-atelier

Rust native core model for the AWS Smithy IDL
MIT License
77 stars 11 forks source link

update dependency to address RUSTSEC-2021-0139 #47

Closed stevelr closed 1 year ago

stevelr commented 2 years ago

cargo-audit identified a RUSTSEC vulnerability in a dependency of atelier_test. This generates a cargo-audit warning in any downstream crate that depends on atelier_test, atelier_assembler, or other crates that indirectly depend on atelier_test.

The affected crate is ansi_term, which is used by pretty_assertions. Updating pretty_assertions to 1.3 eliminates the alert.

Crate:     ansi_term
Version:   0.12.1
Warning:   unmaintained
Title:     ansi_term is Unmaintained
Date:      2021-08-18
ID:        RUSTSEC-2021-0139
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0139
Dependency tree:
ansi_term 0.12.1
└── pretty_assertions 0.7.2
    └── atelier_test 0.1.4

Other library crates in this repo that depend on atelier_test use the minor version 0.1 so don't need to be updated.

Signed-off-by: stevelr steve@cosmonic.com

stevelr commented 2 years ago

Update: the same ansi_term vulnerability is included upstream from cargo-atelier's dependency structopt. To fix. cargo-atelier needs to be updated to use clap v4. Filed this as a separate issue https://github.com/johnstonskj/rust-atelier/issues/49

stevelr commented 2 years ago

fixes https://github.com/johnstonskj/rust-atelier/issues/48