Update gix version - #455
Open
PuercoPop wants to merge 2 commits into
Open
Conversation
The version of the indirect dependency gix-date has a security advisory open against it. See https://rustsec.org/advisories/RUSTSEC-2025-0140. Update to the latest gix version so that we depend on version of gix-date that doesn't have any advisory open against it. ``` $ cargo audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1190 security advisories (from /home/puercopop/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabilities (380 crate dependencies) Crate: gix-date Version: 0.10.5 Title: Non-utf8 String can be created with `TimeBuf::as_str` Date: 2025-12-29 ID: RUSTSEC-2025-0140 URL: https://rustsec.org/advisories/RUSTSEC-2025-0140 Solution: Upgrade to >=0.12.0 [...] error: 1 vulnerability found! warning: 1 allowed warning found ```
The new version of gix requires to either enable the sha1 or sha256 feature
flags. The default is sha1, but we disable the default features. Enable it.
```
error: Please set either the `sha1` or the `sha256` feature flag
--> /home/puercopop/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/gix-hash-0.26.0/src/lib.rs:32:1
|
32 | compile_error!("Please set either the `sha1` or the `sha256` feature flag");
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
``
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi, thanks for bacon 🐽 .
The version of the indirect dependency gix-date has a security advisory open
against it. See https://rustsec.org/advisories/RUSTSEC-2025-0140. Update to the
latest gix version so that we depend on version of gix-date that doesn't have
any advisory open against it.
Had to enable the sha1 feature for git as part of the update. The rationale is in the commit message.
Afterwards cargo audit only lists the warning about the paste crate being unmaintained.