Skip to content
Unverified Commit 168184e5 authored by ysaito1001's avatar ysaito1001 Committed by GitHub
Browse files

Address vulnerabilities reported within the tools directory (#2633)

## Motivation and Context
Addresses vulnerabilities reported by `cargo audit` within the
repository.

## Description
This commit addresses vulnerabilities within the tools directory
reported by `cargo audit`. Mostly they have been fixed by regenerating
`Cargo.lock` files. Two exceptions:
- `crate-hasher` needs to drop the `temp_dir` crate and switch over to
the `tempfile` crate
- `canary-runner` needs to upgrade the `octorust` crate

## Testing
After the PR, no vulnerabilities reported from the crates that have been
patched. Ran `cargo t` on the updated crates.
Furthermore, no vulnerabilities reported currently within `rust-runtime`
and `aws/rust-runtime`:
```
➜  rust-runtime git:(ysaito/fix-cargo-audit) pwd
smithy-rs/rust-runtime
➜  rust-runtime git:(ysaito/fix-cargo-audit) rm Cargo.lock && cargo generate-lockfile && cargo audit
    Updating crates.io index
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 543 security advisories
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (314 crate dependencies)

➜  rust-runtime git:(ysaito/fix-cargo-audit) pwd
smithy-rs/aws/rust-runtime
➜  rust-runtime git:(ysaito/fix-cargo-audit) rm Cargo.lock && cargo generate-lockfile && cargo audit
    Updating crates.io index
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`


      Loaded 543 security advisories
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (249 crate dependencies)
```

----

_By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice._

Co-authored-by: default avatarYuki Saito <awsaito@amazon.com>
parent b50f1e92
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment