RUSTSEC-2022-0040: Multiple soundness issues in owning_ref

[github-actions]

Multiple soundness issues in owning_ref

Details
Package	owning_ref
Version	0.4.1
URL	https://github.com/noamtashma/owning-ref-unsoundness
Date	2022-01-26

• OwningRef::map_with_owner is unsound and may result in a use-after-free.
• OwningRef::map is unsound and may result in a use-after-free.
• OwningRefMut::as_owner and OwningRefMut::as_owner_mut are unsound and may result in a use-after-free.
• The crate violates Rust's aliasing rules, which may cause miscompilations on recent compilers that emit the LLVM noalias attribute.

No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.

See advisory page for additional details.

[DaughterOfMars]

chronicle v1.0.0-beta.6 (Z:\Repositories\inx-chronicle)
├── bee-metrics v0.1.0 (https://github.com/iotaledger/bee?branch=mainnet-develop-0.4#821b8bb3)
│   ├── prometheus-client v0.15.1
│   │   ├── owning_ref v0.4.1

[DaughterOfMars]

OwningRef::map is used by Histogram and Family during encoding. Unfortunately we are potentially affected by this issue.

[grtlr]

I just checked, and we are not using owning_ref anymore from what I can tell.