Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Issue with SQLx 0.7.2 #303

Merged
merged 2 commits into from
Aug 24, 2024
Merged

Security Issue with SQLx 0.7.2 #303

merged 2 commits into from
Aug 24, 2024

Conversation

joelawm
Copy link
Contributor

@joelawm joelawm commented Aug 24, 2024

There seems to have been a critical security issue with SQLx that forced all clients to update. Here is a PR of just updating the version. Let me know if I need to make anymore changes!

Link to RUSTSEC Security Issue

UPDATED:

  • Version bump from 0.7.2 to 0.8.1.

I have run the tests locally and it does seem to partial pass but it keeps throwing duplicate key constraints which seems to me indicates something wrong with the test more than just updating the version because it will pass previously failed tests and just keep swapping between failed and passed. Let me know if I should dig into this further as well.

@joelawm joelawm changed the title Update Security Issue with SQLX 0.7.2 Security Issue with SQLX 0.7.2 Aug 24, 2024
@joelawm joelawm changed the title Security Issue with SQLX 0.7.2 Security Issue with SQLx 0.7.2 Aug 24, 2024
@ChuckHend
Copy link
Member

Thank you for raising and addressing this @joelawm

duplicate key constraints which seems to me indicates something wrong with the test more than just updating the version

There was an issue a while back that I thought we had resolved with tests running concurrently. I think it's basically the create if not exists command resulting a race condition when two tests try to create a table with the same name.

@ChuckHend
Copy link
Member

The failing test is our CI system complaining that the version in Cargo.toml already exists in crates.io for this project. @joelawm if you can bump that version I'll merge right away, or I can merge now and get it released separately.

@joelawm
Copy link
Contributor Author

joelawm commented Aug 24, 2024

No problem! @ChuckHend I just ran using cargo test I looked around briefly to see if there was a more specific command but didn't see any in the documentation. I did look briefly so thats on me if its there haha.

I'll bump the version right now, give me one second!

@joelawm
Copy link
Contributor Author

joelawm commented Aug 24, 2024

Should be good now @ChuckHend

@ChuckHend
Copy link
Member

Thank you!

@ChuckHend ChuckHend enabled auto-merge (squash) August 24, 2024 19:51
@ChuckHend ChuckHend merged commit 7a9bc88 into tembo-io:main Aug 24, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants