Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Blocked: chrono dependency in Substrate] A0-786: Run cargo-audit in pipelines #441

Closed
wants to merge 5 commits into from
Closed

[Blocked: chrono dependency in Substrate] A0-786: Run cargo-audit in pipelines #441

wants to merge 5 commits into from

Conversation

pmikolajczyk41
Copy link
Member

@pmikolajczyk41 pmikolajczyk41 commented May 25, 2022 •
edited
Loading

Description

We add a new workflow running cargo-audit. This required bumping some dependencies (see diff)

Vulnerabilities found:

The second one is hard to fix, since several Substrate packages depend on chrono, which depends on time = 0.1.x, which is no longer maintained and thus not recoverable from RUSTSEC-2020-0071.
Related links:

Type of change

  • New feature (non-breaking change which adds functionality)

@github-actions
Copy link

Please make sure the following happened

  • Appropriate tests created
  • Infrastructure updated accordingly
  • Updated existing documentation
  • New documentation created
  • Bump spec_version and transaction_version if relevant
  • Bump aleph-client version if relevant

@pmikolajczyk41 pmikolajczyk41 changed the title A0-786: Run cargo-audit in pipelines [Blocked: waiting for libp2p update in Substrate] A0-786: Run cargo-audit in pipelines May 25, 2022
@pmikolajczyk41 pmikolajczyk41 changed the title [Blocked: waiting for libp2p update in Substrate] A0-786: Run cargo-audit in pipelines [Blocked: chrono -> time dependency in Substrate] A0-786: Run cargo-audit in pipelines Jun 9, 2022
@pmikolajczyk41 pmikolajczyk41 changed the title [Blocked: chrono -> time dependency in Substrate] A0-786: Run cargo-audit in pipelines [Blocked: chrono dependency in Substrate] A0-786: Run cargo-audit in pipelines Jun 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@pmikolajczyk41