cargo deny: Add new exceptions #30424
Conversation
| # `derivative` is unmaintained; consider using an alternative (unmaintained) | ||
| "RUSTSEC-2024-0388", | ||
| # Multiple soundness issues | ||
| "RUSTSEC-2024-0379", | ||
| # `instant` is unmaintained, and the author recommends using the maintained [`web-time`] crate instead. | ||
| "RUSTSEC-2024-0384", |
There was a problem hiding this comment.
Should we switch to the alternatives instead of ignoring these?
There was a problem hiding this comment.
Yes, definitely, but I didn't want to do it myself, I consider this list to be a big TODO basically
There was a problem hiding this comment.
I guess my question is, why even add these exceptions in the first place? Is it breaking CI or something?
There was a problem hiding this comment.
Yes, we have a "security" pipeline which will ping me every day about this if I don't silence it: https://buildkite.com/materialize/security
There was a problem hiding this comment.
Looking at the commit history of this file, it doesn't look like we have a great track record of actually resolving these issues and removing the ignores. I don't mean to throw a wrench in this and I'm not at all familiar with the process but it sounds like something might be slightly broken with the process.
Maybe the security pings should be going somewhere else, but if our current process is to silence the pings without resolving them, then it doesn't sound like they're that useful in the first place.
There was a problem hiding this comment.
"Multiple soundness issues" for float parsing is a bit scary, I put up #30426 to remove our use. Otherwise IMO the "unmaintained" issues aren't great but aren't too bad either
| # `derivative` is unmaintained; consider using an alternative (unmaintained) | ||
| "RUSTSEC-2024-0388", | ||
| # Multiple soundness issues | ||
| "RUSTSEC-2024-0379", | ||
| # `instant` is unmaintained, and the author recommends using the maintained [`web-time`] crate instead. | ||
| "RUSTSEC-2024-0384", |
There was a problem hiding this comment.
"Multiple soundness issues" for float parsing is a bit scary, I put up #30426 to remove our use. Otherwise IMO the "unmaintained" issues aren't great but aren't too bad either
Checklist
$T ⇔ Proto$Tmapping (possibly in a backwards-incompatible way), then it is tagged with aT-protolabel.