googlefonts / googlefonts/axisregistry
Insecure protobuf rev
Open
--review-axis
- Dominant language
- Rust
- Stars
- 43
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/googlefonts/fontc/security/dependabot/21 suggests we update our version of protobuf.
The path to it appears to be gftools > axisregistry > protobuf and indeed I see the offending version in https://github.com/googlefonts/axisregistry/blob/main/requirements.txt. Although we don't - as far as I know - process arbitrary inputs we might as well update.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.