Skip to content

Update dependencies and adapt user_agent interface#132

Closed
auyer wants to merge 1 commit intokworkflow:unstablefrom
auyer:update-dependencies-to-fix-security-warning
Closed

Update dependencies and adapt user_agent interface#132
auyer wants to merge 1 commit intokworkflow:unstablefrom
auyer:update-dependencies-to-fix-security-warning

Conversation

@auyer
Copy link
Collaborator

@auyer auyer commented Apr 1, 2025

Security warnings found in the current depednencies:

Library Vulnerability Installed Version Fixed Version
hashbrown GHSA-wwq9-3cpr-mm53 0.15.0 0.15.1
idna CVE-2024-12224 0.5.0 1.0.0
ring GHSA-4p46-pwfr-66x6 0.17.8 0.17.12
rustls GHSA-qg5g-gv98-5ffh 0.23.16 0.23.18

This PR fixes them and adapt the user_interface changes in ureq.

Signed-off-by: Rafael Passos <rafael@rcpassos.me>
@auyer auyer force-pushed the update-dependencies-to-fix-security-warning branch from f4a4c3f to dbce01b Compare April 1, 2025 17:22
davidbtadokoro pushed a commit to davidbtadokoro/patch-hub that referenced this pull request Apr 7, 2025
…t()` call

Update version of dependencies with security issues. Below is the list
of it in a CSV format:

library,vulnerability,installed-version,fixed-version
hashbrown,GHSA-wwq9-3cpr-mm53,0.15.0,0.15.1
idna,CVE-2024-12224,0.5.0,1.0.0
ring,GHSA-4p46-pwfr-66x6,0.17.8,0.17.12
rustls,GHSA-qg5g-gv98-5ffh,0.23.16,0.23.18

Also, the `user_agent` method of `ureq::Agent` changed its API, so adapt
this call.

[Maintainer edits]
- Adapt commit message subject to follow conventional commits pattern
  and be more expressive
- Add commit message body adapted from PR kworkflow#132 description

Signed-off-by: Rafael Passos <rafael@rcpassos.me>
Reviewed-by: David Tadokoro <davidbtadokoro@usp.br>
Signed-off-by: David Tadokoro <davidbtadokoro@usp.br>
@davidbtadokoro
Copy link
Collaborator

Hey, @auyer, and thanks for this great catch and well made PR! Change merged into the unstable branch 👍

I just tinkered with the commit message, which you can check in the merged commit in [Maintainer edits].

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants