Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

v1.17: build(deps): bump zerocopy from 0.7.15 to 0.7.31 (backport of #34477) #34506

Merged
merged 2 commits into from
Dec 18, 2023

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Dec 18, 2023

This is an automatic backport of pull request #34477 done by Mergify.
Cherry-pick of a1032ef has failed:

On branch mergify/bp/v1.17/pr-34477
Your branch is up to date with 'origin/v1.17'.

You are currently cherry-picking commit a1032ef42e.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   Cargo.lock
	both modified:   programs/sbf/Cargo.lock

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally


Mergify commands and options

More conditions and actions can be found in the documentation.

You can also trigger Mergify actions by commenting on this pull request:

  • @Mergifyio refresh will re-evaluate the rules
  • @Mergifyio rebase will rebase this PR on its base branch
  • @Mergifyio update will merge the base branch into this PR
  • @Mergifyio backport <destination> will backport this PR on <destination> branch

Additionally, on Mergify dashboard you can:

  • look at your merge queues
  • generate the Mergify configuration with the config editor.

Finally, you can contact us on https://mergify.com

* build(deps): bump zerocopy from 0.7.15 to 0.7.31

Bumps [zerocopy](https://github.com/google/zerocopy) from 0.7.15 to 0.7.31.
- [Release notes](https://github.com/google/zerocopy/releases)
- [Changelog](https://github.com/google/zerocopy/blob/main/CHANGELOG.md)
- [Commits](google/zerocopy@v0.7.15...v0.7.31)

---
updated-dependencies:
- dependency-name: zerocopy
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

* [auto-commit] Update all Cargo lock files

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-buildkite <[email protected]>
(cherry picked from commit a1032ef)

# Conflicts:
#	Cargo.lock
#	programs/sbf/Cargo.lock
@CriesofCarrots
Copy link
Contributor

This backport is to resolve the cargo audit failure:

$ cargo audit --ignore RUSTSEC-2020-0071 --ignore RUSTSEC-2023-0001 --ignore RUSTSEC-2022-0093
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 582 security advisories (from /Users/tyeraeulberg/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (770 crate dependencies)
Crate:     zerocopy
Version:   0.7.11
Title:     Some Ref methods are unsound with some type parameters
Date:      2023-12-14
ID:        RUSTSEC-2023-0074
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0074
Solution:  Upgrade to >=0.2.9, <0.3.0 OR >=0.3.2, <0.4.0 OR >=0.4.1, <0.5.0 OR >=0.5.2, <0.6.0 OR >=0.6.6, <0.7.0 OR >=0.7.31
Dependency tree:
zerocopy 0.7.11

Copy link

codecov bot commented Dec 18, 2023

Codecov Report

Merging #34506 (ac7bddf) into v1.17 (aaa266e) will decrease coverage by 0.1%.
The diff coverage is n/a.

Additional details and impacted files
@@            Coverage Diff            @@
##            v1.17   #34506     +/-   ##
=========================================
- Coverage    81.8%    81.8%   -0.1%     
=========================================
  Files         803      803             
  Lines      218181   218181             
=========================================
- Hits       178538   178489     -49     
- Misses      39643    39692     +49     

@CriesofCarrots CriesofCarrots merged commit 9a328fb into v1.17 Dec 18, 2023
32 checks passed
@CriesofCarrots CriesofCarrots deleted the mergify/bp/v1.17/pr-34477 branch December 18, 2023 18:51
@t-nelson
Copy link
Contributor

did we check out the changes in that 20 patch version range to understand risk of updating vs exposure to the audit finding?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants