onomyprotocol / arc

Arc moves assets cross-chain to and from integrated blockchains.
Apache License 2.0
3 stars 10 forks source link

borsh 0.10.3 has a security advisory #140

Open AaronKutch opened 1 year ago

AaronKutch commented 1 year ago

It is ultimately used by a rust-decimal dependency of deep_space. I need to update the trio of our custom dependencies. I can't remember why rust-decimal is in there, we need to update or remove it. borsh 1.0 is close to releasing, may want to wait for that. Looking at https://github.com/althea-net/deep_space/pulls?q=is%3Apr+is%3Aclosed there are probably some things I need to merge.