Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Merged by Bors] - Updated dependencies, removes remove_dir_all, which is vulnerable #2685

Closed
wants to merge 1 commit into from

Conversation

Razican
Copy link
Member

@Razican Razican commented Mar 17, 2023

After this, we are still waiting for indexmap & dashmap to provide the new hashbrown to reduce duplicate dependencies, and for criterion to remove clap and release a new version. We're also waiting for a new version of icu_datagen that bumps the zip dependency to avoid a potential vulnerability. Ideally, they would also bump the simple_logger dependency, which is pretty outdated. In any case, simple_logger still uses an unmaintained atty dependency.

Relevant issues:

@Razican Razican added this to the v0.17.0 milestone Mar 17, 2023
@Razican Razican added the dependencies Pull requests that update a dependency file label Mar 17, 2023
@github-actions
Copy link

Test262 conformance changes

Test result main count PR count difference
Total 94,277 94,277 0
Passed 71,998 71,998 0
Ignored 17,324 17,324 0
Failed 4,955 4,955 0
Panics 14 14 0
Conformance 76.37% 76.37% 0.00%

@codecov
Copy link

codecov bot commented Mar 17, 2023

Codecov Report

Merging #2685 (05a60a7) into main (50a343a) will increase coverage by 0.17%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #2685      +/-   ##
==========================================
+ Coverage   49.33%   49.50%   +0.17%     
==========================================
  Files         397      394       -3     
  Lines       39610    39446     -164     
==========================================
- Hits        19540    19528      -12     
+ Misses      20070    19918     -152     

see 15 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@jedel1043
Copy link
Member

bors r+

bors bot pushed a commit that referenced this pull request Mar 17, 2023
…2685)

After this, we are still waiting for `indexmap` & `dashmap` to provide the new `hashbrown` to reduce duplicate dependencies, and for `criterion` to remove `clap` and release a new version. We're also waiting for a new version of `icu_datagen` that bumps the `zip` dependency to avoid a potential vulnerability. Ideally, they would also bump the `simple_logger` dependency, which is pretty outdated. In any case, `simple_logger` still uses an unmaintained `atty` dependency.

Relevant issues:
 - xacrimon/dashmap#250
 - unicode-org/icu4x#3150
 - bheisler/criterion.rs#599
 - borntyping/rust-simple_logger#74
@bors
Copy link

bors bot commented Mar 17, 2023

Pull request successfully merged into main.

Build succeeded:

@bors bors bot changed the title Updated dependencies, removes remove_dir_all, which is vulnerable [Merged by Bors] - Updated dependencies, removes remove_dir_all, which is vulnerable Mar 17, 2023
@bors bors bot closed this Mar 17, 2023
@bors bors bot deleted the update_deps branch March 17, 2023 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants