Bump dependencies to fix vulnerability from cargo audit
#223
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of change
Running
cargo audit
in identity.rs currently producing errors due to vulnerabilities in the currentcurve25519-dalek
version:Same audit message could be produces when running
cargo audit
in crypto.rs. This PR bumps the dependencies to fix the vulnerability.Changes:
curve25519-dalek
x25519-dalek
age
u64_backend
forcurve25519-dalek
x25519-dalek
x25519-dalek
:static_secrets
zeroize
cargo clippy
messages from CIThe features
static_secrets
andzeroize
had to be enabled forx25519-dalek
so that identity.rs to be able to use crypto.rs with the updated dependencies.Interestingly, all tests run with
cargo test --lib --all --all-features --tests
completed successfully without the featuresstatic_secrets
andzeroize
, but building identity.rs against a version without those features enabled fails due to:x25519_dalek::StaticSecret
not being found incrypto.rs/src/keys/x25519.rs:105
Zeroize
andZeroizeOnDrop
incrypto.rs/src/keys/x25519.rs:105
So the outward behavior changes without those features.
I'm not entirely sure, if similar behavior changes may affect other dependents similarly for other features.
Type of change
Choose a type of change, and delete any options that are not relevant.
How the change has been tested
cargo audit
on currentdev
should produce the message from above, doing the same on this branch should not.Tested locally and verified with CI.
Change checklist
Add an
x
to the boxes that are relevant to your changes, and delete any items that are not.