RUSTSEC-2023-0052, RUSTSEC-2023-0053

[jxs]

Description

see here, here, it affects us due to libp2p-websockets dependency on futures-rustls, 0053 is easily fixed by cargo upgrading but 0052 hasn't yet a solution

Current Implementation

Are you planning to do it yourself in a pull request?

Maybe.

[thomaseizinger]

Related: #4378.

[jxs]

addressed with #4387 (comment)

[jxs]

sorry this is still failing because of webrtc-rs via webrtc-dtls see webrtc-rs/webrtc#491

[rainliu]

@jxs , webrtc v0.9.0 fixed WebPKI security issue

[jxs]

thanks @rainliu! @thomaseizinger want me to submit a PR with the update or we can wait for dependabot?

[thomaseizinger]

thanks @rainliu! @thomaseizinger want me to submit a PR with the update or we can wait for dependabot?

It should come in very soon! They always come Sunday night :)

[thomaseizinger]

#4475 does not quite resolve this unfortunately. See:

    = webpki v0.22.0
      ├── rustls v0.20.8
      │   ├── hyper-rustls v0.23.2
      │   │   └── fantoccini v0.20.0-rc.4
      │   │       └── thirtyfour v0.32.0-rc.8
      │   │           └── interop-tests v0.1.0
      │   └── tokio-rustls v0.23.4
      │       └── hyper-rustls v0.23.2 (*)
      └── tokio-rustls v0.23.4 (*)