bug-guix
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#56895: rust-brotli-sys bundles (insecure!) brotli


From: Maxime Devos
Subject: bug#56895: rust-brotli-sys bundles (insecure!) brotli
Date: Tue, 2 Aug 2022 20:06:31 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.11.0

I noticed rust-brotli-sys bundles brotli: <https://github.com/bitemyapp/brotli2-rs/blob/master/brotli-sys/build.rs#L16>.

The version it bundles is apparently insecure: <https://github.com/bitemyapp/brotli2-rs/issues/45>

As mentioned at <https://github.com/actix/actix-web/issues/2537>, there have been multiple PR updating it to new PR but they were abandoned, so it appears we have to remove rust-brotli-sys entirely (in favour of rust-brotli?) or merge one of them (or better: unbundle) things on our own.

Greetings,
Maxime.

Attachment: OpenPGP_0x49E3EE22191725EE.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature
Description: OpenPGP digital signature


reply via email to

[Prev in Thread] Current Thread [Next in Thread]