Vulnerable dependencies

[lubo]

I'm reporting this here because there's no security policy and private vulnerability reporting is disabled in this repository.

Yesterday, I added squawk crate into my project. After doing that, GitHub Dependabot opened 21 alerts for Squawk dependencies. I won't provide the list here unless you request it. However, you can find them yourself by enabling Dependabot alerts in this repository.

I assume the alerts are disabled because I see no PRs by Dependabot or relevant changes by you and I assume you wouldn't just let the vulnerabilities sit there if you knew about them. Enabling the alerts wouldn't just help you with the current vulnerabilities, it'd also help you to stay on top of them in the future. Dependabot is usually able to open PRs that upgrade the dependencies to secure versions for you. I'd also recommend setting up Dependabot version updates, so that the project uses current major and minor versions of the dependencies, so that security fixes, usually shipped as patch releases, can be applied right away without any delays.

With that being said, I'm asking you to upgrade the dependencies and ship a security release. Let me know if you need any help.

[sbdchd]

Yeah I find dependabot a bit spammy

Looking through the warnings, I think there's a lot of noisy ones, like regex DOS, prototype pollution, etc.

I've enabled the dependabot scanning and will take a look at them going forward

[sbdchd]

Thanks for the report! Fixed in the latest version: v2.25.0!

[lubo]

#631 (comment) is still not resolved. Is Dependabot not reporting this to you?

[sbdchd]

Yeah doesn't seem like a big deal (https://rustsec.org/advisories/RUSTSEC-2021-0145), there's also some stuff with the dev server for the docs, but upgrading to version 3 of docusaurus is a project.

Feel free to make a PR to upgrade the dep!

[lubo]

While GHSA-g98v-hv3f-hcfr in itself isn't a big deal, it's basically a warning shot. structopt is unmaintained and it depends on a bunch of unmaintained packages, atty being indirectly one of them. As the time goes by, more vulnerabilities without possible mitigations are likely to be discovered in these unmaintained packages.

I've created #642 and can't promise that I'll be able to get to it.