Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cargo Deny Report #926

Open
1 of 19 tasks
lightsing opened this issue Sep 11, 2023 · 1 comment
Open
1 of 19 tasks

Cargo Deny Report #926

lightsing opened this issue Sep 11, 2023 · 1 comment
Labels
enhancement New feature or request

Comments

@lightsing
Copy link
Member

lightsing commented Sep 11, 2023 •
edited
Loading

We have some issues found by cargo-deny:

License Issues

  • fastrlp v0.1.3 is GPL-3.0 licensed:
    • This is a dependency of ethers-core.
    • Solution: upgrade to fastrlp v0.3 is MPL-2.0 licensed.
  • our crates are not licensed:
    • aggregator
    • halo2-base
    • halo2-ecc
    • halo2-gate-generator
    • halo2wrong
    • maingate
    • misc-precompiled-circuit
    • prover
    • snark-verifier
    • snark-verifier-sdk
    • testool

Unmaintained/Deprecated Dependencies Issues

  • serde_cbor is unmaintained.
    • Solution: This is a dependency of criterion, upgrade criterion.
  • dotenv is unmaintained #932
    • Solution: This is a dependency of prover, use dotenvy instead.
  • hermit-abi v0.3.1 is yanked
    • Solution: cargo update -p hermit-abi

Dependencies with vulnerability issues

  • rustls-webpki: CPU denial of service in certificate path building
    • This is a dependency of reqwest
    • Solution: Upgrade it.
  • webpki: CPU denial of service in certificate path building
    • This is a dependency of reqwest and tokio-tungstenite
    • Solution: Upgrade them.
  • time: Potential segfault in the time crate
    • Solution: cargo update -p time
@lispc
Copy link

lispc commented Sep 11, 2023

we plan to upgrade ethers rs soon. Very likely fastrlp will be upgraded then.

@lispc lispc added the enhancement New feature or request label Oct 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lispc @lightsing