rust-xdr
rust-xdr copied to clipboard
rust-xdr v0.4.4 has a vulnerability due to sub-dependency regex v0.2.11
Context
rust-xdr v0.4.4 has a dependency env_logger v0.4.3 which in turn has a sub-dependency regex v0.2.11. However, regex v0.2.11 has a high sev vulnerability linked here. We use rust-xdr v0.4.4 in our package and this is creating security issues for our build. We tried updating rust-xdr but it seems like v0.4.4 is the latest version.
Desired Solution
Update rust-xdr to use a newer version of env_logger or regex such that regex has a version higher than 1.5.5.
PR #43