Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Update reqwest dependency #45

Merged

Conversation

stephaneyfx
Copy link
Contributor

This addresses vulnerability RUSTSEC-2021-0020 reported by cargo-audit.

I have only updated to reqwest 0.10 and not 0.11 because the latter depends on tokio 1 and the async ecosystem hasn't fully migrated yet, so it seems useful to have a version supporting tokio 0.2. Maybe hashicorp_vault 1.2 could use tokio 0.2 and hashicorp_vault 1.3 could switch to tokio 1? -- Note that I haven't checked if a minor or major bump should be done; I'd think tokio is not exposed by this crate because of its use of the blocking reqwest client.

Thank you.

This addresses vulnerability [RUSTSEC-2021-0020](https://rustsec.org/advisories/RUSTSEC-2021-0020) reported by cargo-audit.
@ChrisMacNaughton
Copy link
Owner

This looks like a great change, in terms of version bumping, the reqwest::Response is currently exposed via the VaultResponse error. Even though that's the only place that I expect it's visible, I suspect it should get a major version bump so I think that I'll hold off on a release until #44 lands as well.

@ChrisMacNaughton ChrisMacNaughton merged commit eff4722 into ChrisMacNaughton:master Feb 12, 2021
@stephaneyfx
Copy link
Contributor Author

Thank you for the quick merge and publication!

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants