Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump criterion from 0.4.0 to 0.5.1. #1224

Closed
wants to merge 2 commits into from
Closed

Bump criterion from 0.4.0 to 0.5.1. #1224

wants to merge 2 commits into from

Conversation

martinfrances107
Copy link

As part of #1223 . This PR fixes this security advisory

Crate:     atty
Version:   0.2.14
Warning:   unsound
Title:     Potential unaligned read
Date:      2021-07-04
ID:        RUSTSEC-2021-0145
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0145
Dependency tree:
atty 0.2.14
└── criterion 0.4.0
    └── chrono 0.5.0-alpha.1

@pitdicker
Copy link
Collaborator

This unfortunately doesn't work yet, because criterion has a higher MSRV. See #1104.

@pitdicker
Copy link
Collaborator

If you know a solution that would be great, I didn't look super deep into it.

@martinfrances107
Copy link
Author

I will take a look over the weekend ... thanks for linking to the MSRV issue...
that broadened my perspective.

@djc
Copy link
Member

djc commented Aug 22, 2023

This is a bit silly, because criterion is effectively a dev-dependency. If we treat it as such, we don't need it to uphold our MSRV.

@pitdicker
Copy link
Collaborator

Yes, but even as a dev-dependency it breaks our build because it requires newer cargo features (as you learned me in #1104 (comment)).

@djc
Copy link
Member

djc commented Aug 22, 2023

Ahh, yes, I remember now.

@martinfrances107
Copy link
Author

martinfrances107 commented Aug 23, 2023

Just wanted to confirm bumping the "rust-version" to 1.60.0 will fix the problem ..

If this is an acceptable solution is a different question!!

@pitdicker
Copy link
Collaborator

Criterion is dropped as a dependency in #1243 (moved to a sub-crate and updated to 5.1).

@martinfrances107 Thank you for working on this!

@pitdicker pitdicker closed this Sep 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants