| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Bincode is unmaintained. Right now, we do not depend on it directly,
but rather transitively through maybenot (with tor-proto) and
typed-index-collections (with tor-netdoc).
This has been reported upstream in the respective crates:
* <https://github.com/zheland/typed-index-collections/issues/10>
* <https://github.com/maybenot-io/maybenot/issues/40>
It is pretty unfortunate, but there is not much we can do at the current
moment, given that it is an external matter and we need it for the next
arti release; also, as far as I am aware, there are no known security
vulnerabilities in the current version of bincode.
Therefore, this commit adds it to the list of exception.
Fixes #2311
See #2312
|
| |
|
|
|
|
| |
Ignore RUSTSEC-2025-0052.
Deprecation/removal plan:
https://gitlab.torproject.org/tpo/core/arti/-/issues/2130
|
| | |
|
| |
|
|
| |
Crate humantime is no longer unmaintained
|
| | |
|
| | |
|
| |
|
|
|
| |
The 'notify' lib was recently upgraded to 8.0.0, but that's not the only
place that we depend on 'instant'.
|
| |
|
|
| |
We no longer require a version of hickory that requires an affected idns.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
| |
We depend on `instant`, which is unmaintained, via `notify`.
`notify` switched over to [`web-time`], but hasn't relased the change
yet, so we need to ignore the advisory for now.
[`web-time`]: https://github.com/notify-rs/notify/pull/652
|
| |
|
|
| |
Adding an exception for now, as per #1608
|
| |
|
|
|
| |
Now that it's gone, we no longer need to bless its MPL-2.0 usage
or excuse it from cargo-audit.
|
| |
|
|
|
| |
We don't use the affected crates any more, now that arti-hyper is
gone.
|
| |
|
|
|
| |
We should migrate to `slotmap`, but in the meantime let's just add an
exception to unblock CI.
|
| |
|
|
|
| |
We should have added these to our record of previous rustsec
ignores, but we accidentally removed them instead.
|
| |
|
|
| |
It's no longer necessary now that we have upgraded.
|
| | |
|
| |\
| |
| |
| |
| | |
Upgrade to clap 4
See merge request tpo/core/arti!1735
|
| | | |
|
| |/
|
|
|
| |
Apparently webpki came out of retirement and actually fixed
RUSTSEC-2023-0052. Versions >=0.22.2 should be fine.
|
| |
|
|
|
| |
We've solved this for rustls-webpki, but tls-api (which arti-hyper
uses) still requires the unmaintained webpki crate. See #1016.
|
| |
|
|
|
|
|
| |
This is the API deficiency in ed25519-dalek v1 that allows you to
mismatch public and private keys, leading to a (fatal)
double-signing attack. We have worked around this in our current
design, so it's appropriate to suppress this warning for now.
|
| | |
|
| |
|
|
| |
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
|
|
|
| |
This commit changes the shebang in all shell scripts from absolute
paths (such as `/bin/bash` or `/usr/bin/python3`) to the `/usr/bin/env`
binary with the accompanying interpreter as it's argument.
The reason for this are as follows:
- NixOS cannot work with absolute paths
- BSD systems install their packages in /usr/local/bin
|
| | |
|
| |
|
|
|
|
|
|
| |
This removes the last cargo audit override (for the unmaintained
ansi_term).
Don't mark options as required when they have default values:
see <https://github.com/clap-rs/clap/pull/3793>.
|
| | |
|
| | |
|
| |
|
|
|
| |
This makes it easier to for me to test this script. (I would like to
do this to all of them but it's easier on a case-by-case basis.)
|
| |
|
|
| |
and remove corresponding RUSTSEC from ignored list
|
| | |
|
| | |
|
|
|
As per #309
Update all references. There is one remaining hit for
git-grep '\.sh\b'
namely "build.sh" in maint/reproducible_build, which I think is
the build script for osxcross - ie, an external project.
|
