Skip to content

Commit

Permalink
chore: Fix SQLX vulnerability (#2736)
Browse files Browse the repository at this point in the history
SQLX 0.8.0 had a vulnerability, which didn't affect us. At the time of
discovery, there was no fix. We silenced the warning to unlock
development.

This PR bumps SQLX to 0.8.1 which includes the vulnerability fix and
removes the cargo deny allowlist.

Co-authored-by: perekopskiy <[email protected]>
  • Loading branch information
EmilLuta and perekopskiy authored Aug 26, 2024
1 parent aea3726 commit d8e43e7
Show file tree
Hide file tree
Showing 8 changed files with 71 additions and 66 deletions.
41 changes: 21 additions & 20 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,7 @@ serde_with = "1"
serde_yaml = "0.9"
sha2 = "0.10.8"
sha3 = "0.10.8"
sqlx = "0.8.0"
sqlx = "0.8.1"
static_assertions = "1.1"
structopt = "0.3.20"
strum = "0.26"
Expand Down
4 changes: 1 addition & 3 deletions deny.toml
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@ vulnerability = "deny"
unmaintained = "warn"
yanked = "warn"
notice = "warn"
ignore = [
"RUSTSEC-2024-0363", # allows [email protected] until fix is released, more here -- https://github.com/launchbadge/sqlx/issues/3440
]
ignore = []

[licenses]
unlicensed = "deny"
Expand Down
4 changes: 2 additions & 2 deletions docs/guides/setup-dev.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ yarn set version 1.22.19
# For running unit tests
cargo install cargo-nextest
# SQL tools
cargo install sqlx-cli --version 0.8.0
cargo install sqlx-cli --version 0.8.1

# Foundry
curl -L https://foundry.paradigm.xyz | bash
Expand Down Expand Up @@ -217,7 +217,7 @@ SQLx is a Rust library we use to interact with Postgres, and its CLI is used to
features of the library.

```bash
cargo install --locked sqlx-cli --version 0.8.0
cargo install --locked sqlx-cli --version 0.8.1
```

## Easier method using `nix`
Expand Down
38 changes: 19 additions & 19 deletions prover/Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion prover/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ serde = "1.0"
serde_derive = "1.0"
serde_json = "1.0"
sha3 = "0.10.8"
sqlx = { version = "0.8.0", default-features = false }
sqlx = { version = "0.8.1", default-features = false }
structopt = "0.3.26"
strum = { version = "0.26" }
tempfile = "3"
Expand Down
Loading

0 comments on commit d8e43e7

Please sign in to comment.