Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update to address a vulnerable dependency as soon as possible. #50

Open
lgarron opened this issue Apr 5, 2024 · 0 comments
Open

Update to address a vulnerable dependency as soon as possible. #50

lgarron opened this issue Apr 5, 2024 · 0 comments

Comments

@lgarron
Copy link
Member

lgarron commented Apr 5, 2024

  • We use the latest version of cbindgen (0.26.0).
  • It requires the use of clap 3.2.25.
  • clap 3 depends on atty, which has a vulnerability and is unmaintained.

Although we use clap 4 ourselves, we can't force an upgrade for the transitive dependency.

cbindgen attempted to resolve this in September, but it was reverted:

The dependency is now bumped again as of February 26: mozilla/cbindgen#912

However, we're still waiting on a release of cbindgen to address the vulnerability alert on this repo.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@lgarron