Skip to content

Conversation

@Dylan-DPC
Copy link

Bumps the dependency to at least 2.2.3 as per the advisory

Advisory

(even though this crate may not be using the function mentioned in the advisory, it is better to bump it to ensure that there is no chance of other dependencies pulling it)

@ParkMyCar
Copy link
Owner

Thanks for the PR @Dylan-DPC! While it's always a good idea to use the latest version of dependencies, I would like to keep the requirements for compact_str itself as broad as possible and let users drive dependency selection.

For example, say someone is using compact_str and diesel in a personal project that will never be exposed to external users, it would be unfortunate if the use of compact_str caused dependency selection issues because we required >=2.2.3.

I appreciate you bringing the security advisory to my attention though and I just bumped the version we use in examples, #416.

@ParkMyCar ParkMyCar closed this Dec 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants