rustsec

rustsec copied to clipboard

Fixes #1372.

djc

When running the following commands in a powershell on Windows, I am getting no error at all: ```shell $ cargo audit --db '/dfgdfgdfg/dfgdfgdfg/test' -n Loaded 0 security advisories (from /dfgdfgdfg/dfgdfgdfg/test)...

jadinm

Update petgraph to 0.7.1

3

See https://github.com/petgraph/petgraph/blob/petgraph%40v0.7.1/RELEASES.rst. This is a SemVer-incompatible update only because petgraph’s exposed dependency fixedbitset was updated SemVer-incompatibly, but rustsec’s use of the petgraph APIs is straightforward, and no code changes appear...

musicinmybrain

`cargo audit` is not safe to run on untrusted projects

2

Due to `cargo audit` being a Cargo plugin, and calling Cargo internally to generate a lockfile if it's out of date or missing, `cargo audit` is affected by both arbitrary...

Shnatsel

I would like the dependency tree to be serialized and printed for each of the items in the report when using JSON format. The immediate use case is to then...

lcian

Seen [here](https://gitlab.kitware.com/utils/rust-ghostflow/-/jobs/10844391), copied for posterity: ``` error: 2 denied warnings found! Crate: ring Version: 0.16.20 Warning: unmaintained Title: *ring* is unmaintained Date: 2025-02-20 ID: RUSTSEC-2025-0007 URL: https://rustsec.org/advisories/RUSTSEC-2025-0007 Dependency tree: ring...

mathstuf

`status_warn!` macro breaks JSON output

1

Abscissa's `status_warn!` macro prints to stdout, not stderr. This causes `cargo audit` to output non-JSON status strings in JSON output mode. This breaks anything that consumes JSON output of `cargo...

Shnatsel

[cargo-lock] Usage of `DEFAULT_BRANCH` not consistent with behavior of Cargo

2

When parsing lock files, `cargo-lock` sets `master` as the default branch for each git dependency that lacks a branch/revision/tag ([see here](https://github.com/rustsec/rustsec/blob/bd6fb0fba41246ed860e0e8374d8f31aceabc8f9/cargo-lock/src/package/source.rs#L127)). There's two problems with this: 1. This does not...

tvsfx

tame-index / gix dependencies outdated (does dependabot ignore them?)

3

We're working on updating `gix` to the latest version (0.70.0) in Fedora Linux, among other things to avoid the latest RUSTSEC advisory for it: https://rustsec.org/advisories/RUSTSEC-2025-0001.html I see tame-index update PRs...

decathorpe

> gix-worktree-state nonexclusive checkout sets executable files world-writable | Details | | | ------------------- | ---------------------------------------------- | | Package | `gix-worktree-state` | | Version | `0.13.0` | | URL |...

github-actions[bot]