search

paritytech / litep2p

Peer-to-peer networking library
MIT License
67 stars 8 forks source link

Please remove rustls 0.20.9 from dependencies #216

Open nazar-pc opened 3 weeks ago

nazar-pc commented 3 weeks ago

It triggers security advisory that I have to suppress in our Substrate-based project because of litep2p: https://rustsec.org/advisories/RUSTSEC-2024-0336.html

dmitry-markin commented 3 weeks ago

This should be mitigated by not enabling QUIC transport once we release the version with optional transports. Meanwhile I will look what can be done, upgrading quinn should be enough.