http-types icon indicating copy to clipboard operation
http-types copied to clipboard

Published 20 hours ago • verified publisher icon http-rs

Update rand dependency because of RUSTSEC-2021-0023

Open jhorstmann opened this issue 3 years ago • 15 comments

There is an open rustsec issue (RUSTSEC-2021-0023) about a transitive dependency of http-types 2.12.0. On the main branch this seems to be fixed by migrating to fastrand but I think this might also warrant a maintenance release.

jhorstmann avatar Feb 21 '22 10:02 jhorstmann

CI failures are caused by clippy, at least one looks like an actual bug that was already fixed on the main branch

jhorstmann avatar Mar 28 '22 09:03 jhorstmann

I have a PR that fixes the lints which we can hopefully base this on top of: https://github.com/http-rs/http-types/pull/399

arlyon avatar Mar 29 '22 09:03 arlyon

Re-running CI now that #399 was merged

Fishrock123 avatar May 10 '22 00:05 Fishrock123

Needs a rebase it seems

Fishrock123 avatar May 10 '22 18:05 Fishrock123

@Fishrock123 I don't see a merge conflict on this branch. Seems like it can be merged?

seanlinsley avatar Jun 13 '22 16:06 seanlinsley

@Fishrock123 any chance this could be merged?

jakubadamw avatar Sep 01 '22 12:09 jakubadamw

Rebased. There might be new clippy lints since the last update, let's see.

jhorstmann avatar Oct 04 '22 12:10 jhorstmann

@Fishrock123 How can we help get this merged and a new release?

nox avatar Oct 14 '22 10:10 nox

@nox it would help to open a PR fixing the broken clippies. They're not broken because of this PR, but they are blocking merge

jbr avatar Oct 14 '22 17:10 jbr

@jbr https://github.com/http-rs/http-types/pull/512

nox avatar Oct 16 '22 09:10 nox

@jhorstmann I've made a PR fixing the clippy lints and it got merged. Care to rebase this PR on top of current master? Thanks.

nox avatar Oct 19 '22 11:10 nox

@nox did you mean cherry-pick instead? My idea here was to apply the change to the 2.x branch for a maintenance release. The master branch seems to have switched to a different crate for random numbers.

Looking at the rustsec advisory again it also seems that rand 0.7 / rand_core 0.5 was never affected. Maybe the advisory was updated, or the tool we use at work for scanning dependencies had wrong information.

An updated maintenance release would still be nice.

jhorstmann avatar Oct 19 '22 21:10 jhorstmann

@nox did you mean cherry-pick instead? My idea here was to apply the change to the 2.x branch for a maintenance release. The master branch seems to have switched to a different crate for random numbers.

Yeah sorry, I just meant to tell you about the lint fixes so we can get this merged and released as some 2.y.z version.

nox avatar Oct 20 '22 10:10 nox

I just realised that the lints were independently fixed, so it seems all we need is a rebase, @jhorstmann.

nox avatar Oct 20 '22 10:10 nox

Ah, different lints were fixed, never mind.

nox avatar Oct 20 '22 10:10 nox