Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update libgit2-sys, resolve dependabot vulnerability #125

Merged
merged 1 commit into from
Feb 21, 2024

Conversation

who-biz
Copy link
Contributor

@who-biz who-biz commented Feb 20, 2024

Addresses the following security advisory from GitHub's dependabot:
https://github.com/EpicCash/epic/security/dependabot/128

This fix only affects build-time dependencies. Version update was required for built crate, which pulled in the vulnerable libgit2-sys via its own dependencies.

The rest of the changes consist of: 1.) adjusting usage of the built crate for newer version, 2.) Adding git and cargo-lock as features to built crate (these are no longer default features), and 3.) Removal of deprecated function calls from codebase to accommodate.

Tested fully, and built_info fields such as built_info::GIT_VERSION, PKG_VERSION, DEPENDENCIES etc are all generating correct values.

@who-biz who-biz merged commit d1f0055 into EpicCash:master Feb 21, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants