Skip to content

Dependency cargo 0.73.1 has a vulnerable dependency #23

@nspin

Description

@nspin

cargo-audit output:

    Scanning Cargo.lock for vulnerabilities (530 crate dependencies)
Crate:     gix-transport
Version:   0.32.0
Title:     gix-transport code execution vulnerability
Date:      2023-09-23
ID:        RUSTSEC-2023-0064
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0064
Solution:  Upgrade to >=0.36.1
Dependency tree:
gix-transport 0.32.0
├── gix-protocol 0.33.2
│   └── gix 0.45.1
│       └── cargo 0.73.1
│           └── cargo-helpers 0.1.0
└── gix 0.45.1

error: 1 vulnerability found!

This dependency has been bumped upstream (rust-lang/cargo#12731), but that fix has not yet made it into a version of the cargo crate on crates.io. When it does, we should bump the version of the cargo crate used in this project.

Note that the cargo-helpers crate is not exposed to users of this project, and is also not affected by this vulnerability. Regardless, we should bump its cargo crate dependency version as soon as a newer one is available.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions