Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bridge: remove rustix via clap bump (#1109)
Refs: <https://github.com/svix/svix-webhooks/security/dependabot/74> Formerly we had a runtime dep on a vulnerable version of `rustix`. This was transitive, and introduced via `clap`. Bumping clap removed this dependency from our tree. There is still one vulnerable version introduced via `opentelemetry-otlp`, but since it's a build-dep it's less of a concern (see the advisory for the rationale). ``` $ cargo tree -p [email protected] -i rustix v0.38.8 βββ tempfile v3.7.1 βββ prost-build v0.11.9 βββ tonic-build v0.8.4 [build-dependencies] βββ opentelemetry-proto v0.1.0 βββ opentelemetry-otlp v0.11.0 βββ svix-bridge v1.13.0 (/home/onelson/Projects/svix-webhooks/bridge/svix-bridge) ``` If we can update the various otel-related deps, we might be able to bump `rustix` or remove it entirely, but that's a bigger lift.
- Loading branch information