update dependencies #70
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yeah sure please go ahead |
crates.io testing status dependency status
|
Badges, ci, and dependabot added. Actually now that I look at it the vuln was updated out already. The issue is a new release hasn't been tagged for 14 commits / 128 days |
|
Thanks, I'll go ahead and release a new version. |
|
new version has been released to crates.io and with prebuilt binaries |
|
Awesome, thanks! I've got another PR open for the other updates (not fixing vulns) but there's some breaking changes I'm wrestling with around rusttls 😩 |
|
yeah, tokio-rustls isn't updated yet it seems #72 (comment) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Update dependencies to resolve tokio 1.6.1: RUSTSEC-2021-0072, patched: >=1.5.1, <1.6.0; >=1.6.3, <1.7.0; >=1.7.2, <1.8.0; >=1.8.1
NixOS/nixpkgs#141368
It might be worth adding dependabot if you don't want to remember intermittent dependency updates. Or at least set up the cargo audit GH action to run intermittently https://github.com/actions-rs/audit-check or if you don't like GH actions you could just trigger cargo-audit yourself.
I'm happy to add dependabot and the audit action in this PR if you're ok with that