Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: bump ed25519-dalek package version #11986

Closed
yufansong opened this issue Aug 31, 2023 · 1 comment
Closed

chore: bump ed25519-dalek package version #11986

yufansong opened this issue Aug 31, 2023 · 1 comment
Assignees
Labels
type/bug Something isn't working
Milestone

Comments

@yufansong
Copy link
Member

Describe the bug

In #11924 , it contains a dependency with security bugs. The async-nats will introduce the ed25519-dalek package. It need to be upgraded.

Crate:     ed25519-dalek
Version:   1.0.1
Title:     Double Public Key Signing Function Oracle Attack on `ed25519-dalek`
Date:      2022-06-11
ID:        RUSTSEC-2022-0093
URL:       https://rustsec.org/advisories/RUSTSEC-2022-0093
Solution:  Upgrade to >=2
Dependency tree:
ed25519-dalek 1.0.1
└── nkeys 0.3.1
    └── async-nats 0.31.0
        └── risingwave_connector 1.1.0-alpha
            ├── risingwave_stream 1.1.0-alpha
            │   ├── risingwave_ctl 1.1.0-alpha
            │   │   ├── risingwave_simulation 0.1.0
            │   │   ├── risingwave_cmd_all 1.1.0-alpha
            │   │   └── risingwave_cmd 1.1.0-alpha
            │   │       └── risingwave_cmd_all 1.1.0-alpha
            │   └── risingwave_compute 1.1.0-alpha
            │       ├── risingwave_simulation 0.1.0
            │       ├── risingwave_cmd_all 1.1.0-alpha
            │       └── risingwave_cmd 1.1.0-alpha
            ├── risingwave_source 1.1.0-alpha
            │   ├── risingwave_stream 1.1.0-alpha
            │   ├── risingwave_frontend 1.1.0-alpha
            │   │   ├── risingwave_stream 1.1.0-alpha
            │   │   ├── risingwave_sqlsmith 1.1.0-alpha
            │   │   │   └── risingwave_simulation 0.1.0
            │   │   ├── risingwave_simulation 0.1.0
            │   │   ├── risingwave_planner_test 1.1.0-alpha
            │   │   ├── risingwave_ctl 1.1.0-alpha
            │   │   ├── risingwave_cmd_all 1.1.0-alpha
            │   │   └── risingwave_cmd 1.1.0-alpha
            │   ├── risingwave_compute 1.1.0-alpha
            │   └── risingwave_batch 1.1.0-alpha
            │       ├── risingwave_frontend 1.1.0-alpha
            │       └── risingwave_compute 1.1.0-alpha
            ├── risingwave_simulation 0.1.0
            ├── risingwave_meta 1.1.0-alpha
            │   ├── risingwave_simulation 0.1.0
            │   ├── risingwave_hummock_test 1.1.0-alpha
            │   │   ├── risingwave_stream 1.1.0-alpha
            │   │   └── risingwave_compaction_test 1.1.0-alpha
            │   ├── risingwave_ctl 1.1.0-alpha
            │   ├── risingwave_compaction_test 1.1.0-alpha
            │   ├── risingwave_cmd_all 1.1.0-alpha
            │   ├── risingwave_cmd 1.1.0-alpha
            │   └── risingwave_backup_cmd 1.1.0-alpha
            ├── risingwave_frontend 1.1.0-alpha
            ├── risingwave_ctl 1.1.0-alpha
            ├── risingwave_compute 1.1.0-alpha
            └── risingwave_batch 1.1.0-alpha

Error message/log

No response

To Reproduce

No response

Expected behavior

No response

How did you deploy RisingWave?

No response

The version of RisingWave

No response

Additional context

No response

@yufansong yufansong added the type/bug Something isn't working label Aug 31, 2023
@github-actions github-actions bot added this to the release-1.2 milestone Aug 31, 2023
@TennyZhuang TennyZhuang modified the milestones: release-1.2, release-1.3 Sep 11, 2023
@xxchan
Copy link
Member

xxchan commented Sep 20, 2023

fixed in #12227

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants