You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello 👋
[This advisory](GHSA-x4mq-m75f-mx8m) has
been bothering me since a while.
The origin of it is
[`acid_io`](https://github.com/dataphract/acid_io/blob/v0.1.0/Cargo.toml#L28),
where the [issue has been
fixed](dataphract/acid_io#21), but no release
has been publish 😞 (since 3 years!)
So, after reading this
[discussion/issue](rust-lang/rust#48331), I
decided to replace `acid_io` for
[`core2`](https://crates.io/crates/core2) (which seems quite used, even
if the last release was 2 years ago).
The changes was trivial as `acid_io` and `core2::io` have the same API
as `std::io`. But, while trying to test those changes, the CI failed
(which was also the case [`last
week`](https://github.com/dequbed/rsasl/actions/runs/8870496836)). So I
started to fix the CI, and made changes to make the CI pass.
I also added a `dependabot.yaml`, PR will be created monthly to update
the dependencies in the `Cargo.toml` and `ci.yml`.
I formatted the `README.md` and `Cargo.toml`.
I had to bump MSRV to 1.65.
I bumped the dependencies to their latest versions, and pushed the
`Cargo.lock`, see
[`why`](https://doc.rust-lang.org/cargo/faq.html#why-have-cargolock-in-version-control).
And I ran `cargo clippy --fix` and `cargo fmt`, with not much
modification from myself.
I just finished to write the description of this PR and realize that
someone was working on #36, oops
0 commit comments