Cargo audit showing issue with latest Candid
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 301
- Forks
- 85
- Avg merge
- 1h 4m
- Merged PRs (30d)
- 4
Description
Crate: paste
Version: 1.0.15
Warning: unmaintained
Title: paste - no longer maintained
Date: 2024-10-07
ID: RUSTSEC-2024-0436
URL: https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
└── candid 0.10.14
├── ic-management-canister-types 0.3.1
│ └── ic-cdk 0.18.3
│ └── backend 0.1.0
├── ic-cdk-macros 0.18.3
│ └── ic-cdk 0.18.3
├── ic-cdk 0.18.3
└── backend 0.1.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Cargo dependency tree shown in the report and inspect how candid 0.10.14 brings in paste 1.0.15. Run cargo audit to reproduce RUSTSEC-2024-0436, then determine the supported dependency change needed to remove the unmaintained crate and verify that the audit no longer reports it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100