Sergey "Shnatsel" Davidoff

README example is vulnerable to SQL injection

1

The example in the README uses the following code to build a query: ```rust // Query let mut rs = client .job() .query( project_id, QueryRequest::new(format!( "SELECT COUNT(*) AS c FROM...

37% of the time is spent allocating/freeing memory

3

I've run `/usr/bin/time target/release/jxl-oxide decode` on the attached image and noticed that the time spent in the kernel is very high: `0.90user 0.54system 0:00.53elapsed 271%CPU` Measured on commit c8d528ddde518507d4889cb15318be76b879550a Test...

This is how the `bom_ref` for a `component` in CycloneDX format is currently generated: https://github.com/psastras/sbom-rs/blob/eebf46fe0050ab30e750c6b77a705e673dfbecf0/cargo-sbom/src/util/cyclonedx/mod.rs#L102-L107 This causes it to be non-unique in case there are several instances of a crate...

Integrate improvements from `cargo cyclonedx`?

3

I have recently [overhauled](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/cargo-cyclonedx/CHANGELOG.md) a similar tool, `cargo cyclonedx`. I think `cargo sbom` would benefit from some of the improvements I made there, specifically: - The ability to generate the...

Allow using `rustls` instead of OpenSSL

11

In `cargo audit` we're looking to get rid of OpenSSL because of its security track record. So we need `crates-index` to allow using `rustls` instead of OpenSSL. There is a...

Ships #755

Depends on #749 Fixes #741 Also add `exclude` directives to `Cargo.toml` to cut the tarball size in half. You'd think you could just stick `#[cfg(test)]` on a module and call...

Adding every new spec version required an API break anyway, so there isn't any benefit to having `#[non_exhaustive]`. However, this `#[non_exhaustive]` has caused serious real-world bugs: https://github.com/CycloneDX/cyclonedx-rust-cargo/pull/722 https://github.com/CycloneDX/cyclonedx-rust-cargo/pull/723 So drop...

Allow configuring what package "v1.2.3" tags refer to

1

In https://github.com/rust-secure-code/cargo-auditable I have started out tagging the versions of `cargo auditable` itself, but the project has since grown and gained several more binaries. So I have versions like `v0.5.0`...

Provide a way to create releases for pre-existing tags

4

I am [adding](https://github.com/rust-secure-code/cargo-auditable/pull/152) `cargo dist` to my project, [`cargo auditable`](https://github.com/rust-secure-code/cargo-auditable). I would like to build binaries for the latest release, which was cut before I added `cargo dist`. As per...