search

pajowu / signal-backup-decode

Decode Signal Backups
GNU General Public License v3.0
212 stars 17 forks source link

Please review your dependencies. #10

Open dpc opened 5 years ago

dpc commented 5 years ago

Hi,

I'm the author of https://github.com/dpc/crev/tree/master/cargo-crev - a tool for keeping check of your dependencies.

I was doing review of crates from https://crates.io/users/IvanUkhov, since I had previous instances when I accidentally used a poor quality dependency from this user, and it looks like he has a lot of poor quality, incomplete, name-squatting crates. One of them is sqlite which you seem to be using.

I have not found any problems with that crate, but since it's a FFI crate, and I'm suspicious of this user, I would advise double-checking it, and maybe considering alternatives.

I would also advise to try https://github.com/dpc/crev/tree/master/cargo-crev, which might help with identifying problems like this in the future.

mutlusun commented 3 years ago

Hello,

this is fixed in the latest version.