Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rust crate prettytable-rs to ^0.10 [SECURITY] #132

Merged
merged 1 commit into from
Dec 31, 2022

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 30, 2022

Mend Renovate

This PR contains the following updates:

Package Type Update Change
prettytable-rs dependencies minor ^0.9 -> ^0.10

GitHub Vulnerability Alerts

GHSA-gfgm-chr3-x6px

In function Table::as_ref, a reference of vector is force cast to slice. There are multiple problems here:

  1. To guarantee the size is correct, we have to first do Vec::shrink_to_fit. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB).
  2. Even if (1) is sound, &Vec<T> and &[T] still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).

Release Notes

phsym/prettytable-rs

v0.10.0

Compare Source

Fixed

  • Fix panic due to incorrect ANSI escape handling (#​137)
  • Fix display of empty tables (#​127)

Changed

  • Remove the unsafe code in Table::as_ref (#​146)
  • Switch atty to is-terminal (#​151)
  • Minimal Supported Rust Version bumped to 1.56

Thanks


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@zdz zdz merged commit 90a89c2 into master Dec 31, 2022
@renovate renovate bot deleted the renovate/crate-prettytable-rs-vulnerability branch December 31, 2022 06:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant