Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependabot raised a soundness issue with Rust lexical-core dependency #3360

Open
patchwork01 opened this issue Sep 25, 2024 · 0 comments
Open
Labels
bug Something isn't working
Milestone

Comments

@patchwork01
Copy link
Collaborator

See Dependabot alert:
https://github.com/gchq/sleeper/security/dependabot/24

This seems to indicate there's an issue that could be picked up by cargo audit, which we're using in GitHub Actions to check for security issues in our Rust code. See also:

https://github.com/rustsec/rustsec/blob/main/cargo-audit/README.md
https://rustsec.org/advisories/RUSTSEC-2023-0055

The cargo audit documentation says it uses the RustSec database, and the RustSec database seems to agree with Dependabot. We can see if we need to configure cargo audit further to fail on this sort of problem.

@patchwork01 patchwork01 added the bug Something isn't working label Sep 25, 2024
@patchwork01 patchwork01 added this to the 0.26.0 milestone Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant