Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TOB-FUEL-27: Dependencies are yanked or unsound #1329

Closed
xgreenx opened this issue Aug 28, 2023 · 1 comment · Fixed by #1415
Closed

TOB-FUEL-27: Dependencies are yanked or unsound #1329

xgreenx opened this issue Aug 28, 2023 · 1 comment · Fixed by #1415
Assignees
@xgreenx
Labels
audit-report Somehow related to the audit report

Comments

@xgreenx
Copy link
Collaborator

xgreenx commented Aug 28, 2023

Description

The fuel-core project uses yanked dependencies like [email protected] and [email protected]. Furthermore, the fuel-vm and fuel-core projects both depend on the unmaintained library atty with soundness issues on Windows.

Recommendations

Short term, run cargo update which will update the yanked dependencies. Additionally, upgrade criterion to 0.5 across the projects. Unfortunately, datatest-stable has a transitive dependency on atty which can not be avoided until a new version of datatest-stable is released.
Long term, run cargo-audit in the CI and report its output. Note, that the cargo-audit tool scans the Cargo.lock file which includes false-positives due to optional dependencies.
@xgreenx xgreenx added the audit-report Somehow related to the audit report label Aug 28, 2023
@xgreenx
Copy link
Collaborator Author

xgreenx commented Aug 28, 2023 •
edited
Loading

We run cargo update before the publishing of a new release of fuel-core. But it is not required action and is done manually. Maybe we can automate it somehow.

The cargo audit is running on a nightly basis.

@xgreenx xgreenx mentioned this issue Aug 28, 2023
Closed
@xgreenx xgreenx mentioned this issue Oct 12, 2023
Merged
@xgreenx xgreenx self-assigned this Oct 12, 2023
xgreenx added a commit that referenced this issue Oct 12, 2023
@xgreenx
Updated CI to run cargo update weekly (#1415)
79baef4 
I copied the flow from
[rust-lang](https://github.com/rust-lang/rust/blob/master/.github/workflows/dependencies.yml).

It closes #1329.
crypto523 added a commit to crypto523/fuel-core that referenced this issue Oct 7, 2024
@crypto523
Updated CI to run cargo update weekly (#1415)
5806700 
I copied the flow from
[rust-lang](https://github.com/rust-lang/rust/blob/master/.github/workflows/dependencies.yml).

It closes FuelLabs/fuel-core#1329.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@xgreenx xgreenx

Labels
audit-report Somehow related to the audit report
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Updated CI to run cargo update weekly FuelLabs/fuel-core
1 participant
@xgreenx