search

tembo-io / pgmq

A lightweight message queue. Like AWS SQS and RSMQ but on Postgres.
PostgreSQL License
2.68k stars 71 forks source link

Security Issue with SQLx 0.7.2 #303

Closed joelawm closed 2 months ago

joelawm commented 2 months ago

There seems to have been a critical security issue with SQLx that forced all clients to update. Here is a PR of just updating the version. Let me know if I need to make anymore changes!

Link to RUSTSEC Security Issue

UPDATED:

I have run the tests locally and it does seem to partial pass but it keeps throwing duplicate key constraints which seems to me indicates something wrong with the test more than just updating the version because it will pass previously failed tests and just keep swapping between failed and passed. Let me know if I should dig into this further as well.

ChuckHend commented 2 months ago

Thank you for raising and addressing this @joelawm

duplicate key constraints which seems to me indicates something wrong with the test more than just updating the version

There was an issue a while back that I thought we had resolved with tests running concurrently. I think it's basically the create if not exists command resulting a race condition when two tests try to create a table with the same name.

ChuckHend commented 2 months ago

The failing test is our CI system complaining that the version in Cargo.toml already exists in crates.io for this project. @joelawm if you can bump that version I'll merge right away, or I can merge now and get it released separately.

joelawm commented 2 months ago

No problem! @ChuckHend I just ran using cargo test I looked around briefly to see if there was a more specific command but didn't see any in the documentation. I did look briefly so thats on me if its there haha.

I'll bump the version right now, give me one second!

joelawm commented 2 months ago

Should be good now @ChuckHend

ChuckHend commented 2 months ago

Thank you!