Upgrade crates with known vulnerabilities

[m-lord-renkse]

Description

Upgrade crates with known vulnerabilities

Changes

Several crates have been updated to avoid known vulnerabilities

How to test

1. Regression tests passing

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2024-0020

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2023-0052

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2023-0053

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2023-0072

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2021-0145 (still not solved with this update, they are working on it)

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2024-0003

[m-lord-renkse]

https://rustsec.org/advisories/RUSTSEC-2024-0019

[squadgazzz]

Not sure about upgrading transitive dependencies directly through the cargo.lock. How about upgrading libs from the cargo.toml that import outdated dependencies?

[m-lord-renkse]

Not sure about upgrading transitive dependencies directly through the cargo.lock. How about upgrading libs from the cargo.toml that import outdated dependencies?

Updating dependencies in .lock file when it is minor versions is totally fine (I don't modify the file itself, I do cargo update X) and recommendable for the cases in which the parent crate didn't release a fix yet (which is very common sadly). I did it like that so I am not doing too many changes, but I am happy to bump all those crates to newest version!

@squadgazzz for example, the dependency whoami, if you update sqlx, you are forced to update chrono (which has breaking changes btw), and then, the whoami version will still be 1.4.1. Not good. But again, I am more than happy to bump all the crates if necessary!

Another reason why it is safe. Remove Cargo.lock (as if the project was brand new), and compile, you will see... (ignore chrono :D)

[MartinquaXD]

Nice initiative!
BTW there is also cargo audit fix which adds a lot of additional changes to the lockfile. Did you consider using that instead?

[m-lord-renkse]

Nice initiative! BTW there is also cargo audit fix which adds a lot of additional changes to the lockfile. Did you consider using that instead?

umm first time I heard of cargo audit fix, I don't see it in the docs 🤔 do you know how is it used? it would be really nice indeed

[MartinquaXD]

It's a separate command that can be added to cargo itself. More information can be found here: https://crates.io/crates/cargo-audit

[m-lord-renkse]

It's a separate command that can be added to cargo itself. More information can be found here: https://crates.io/crates/cargo-audit

ah I has to be installed with a feature flag, I see. I didn't know, thanks!! I did it and it didn't update anything else besides what I updated in this PR.