Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update version of the object and ruzstd crates to address vulnerabili…
…ty RUSTSEC-2024-0400 Summary: The crate `ruzstd-0.7.2` has vulnerability [RUSTSEC-2024-0400](https://osv.dev/vulnerability/RUSTSEC-2024-0400). This is from an indirect reference ``` addr2line-0.24.2 => object-0.36.5 => ruzstd-0.7.2 ``` To fix, updated the following versions ``` object-0.32.1 to object-0.32.2 object-0.36.5 to object-0.36.7 object-0.30.3 to object-0.30.4 ruzstd-0.4.0 to ruzstd-0.5.0 ruzstd-0.7.2 to ruzstd-0.7.3 delete thiserror-core and thiserror-core-impl (was only used by ruzstd-0.4.0) ``` All the real changes are in the file `third-party/rust/Cargo.lock`, and I had to add `third-party/rust/fixups/object/fixups.toml` file to workaround a build script introduced in `object-0.36.7` with some rustc versioning check that is unnecessary for Meta repo. Unfortunately I had to manually edit `third-party/rust/Cargo.lock` which is supposed to be a generated file. But I verified the change is stable (running `fbcode/common/rust/tools/reindeer/vendor` on top of this resulted in no changes). I did try to use the `fbcode/common/rust/tools/reindeer/version-bump` command, but it tried to boil the ocean and updated everything which not only resulted in many build errors but also is a bad idea to do in one go. All the version changes above was cherry-picked from the `version-bump` script though. Reviewed By: capickett Differential Revision: D69505277 fbshipit-source-id: e88dbca60245b4ae715f49195cde1ccf06c1bf98
- Loading branch information