Repository navigation
Update dependencies with reported vulnerabilities - #112217
Conversation
bumpalo 3.12.1 (yanked) * updated to 3.13.0 tokio 1.8.4 - https://rustsec.org/advisories/RUSTSEC-2023-0001 * updated to 1.28.2 remove_dir_all 0.5.3 - https://rustsec.org/advisories/RUSTSEC-2023-0018 * removed by using the standard library function in `rust-installer` instead and updating to `tempfile@3.5.0` (which also removes the dependency).
|
(rustbot has picked a reviewer for you, use r? to override) |
|
These commits modify the If this was unintentional then you should revert the changes before this PR is merged. |
|
I am a little worried about the remove_dir_all change, but I'm going to go ahead with this and we'll see if we get reports of breakage. (The semantics of the standard library implementation are a little different, AFAIK, particularly on Windows; std tries less hard to clean things up). @bors r+ rollup=iffy |
|
☀️ Test successful - checks-actions |
|
Finished benchmarking commit (dff88b2): comparison URL. Overall result: ✅ improvements - no action needed@rustbot label: -perf-regression Instruction countThis is a highly reliable metric that was used to determine the overall result at the top of this comment.
Max RSS (memory usage)ResultsThis is a less reliable metric that may be of interest but was not used to determine the overall result at the top of this comment.
CyclesResultsThis is a less reliable metric that may be of interest but was not used to determine the overall result at the top of this comment.
Binary sizeThis benchmark run did not return any relevant results for this metric. Bootstrap: 644.74s -> 648.734s (0.62%) |
Vulnerable dependencies:
rust-installerinstead and updating totempfile@3.5.0(which also removes the dependency).The new dependencies come from
tempfile@3.5.0which adds the dependency onrustix