Skip to content

fix(deps): bump tokio-postgres to 0.7.18 - #465

Open
tobyhede wants to merge 1 commit into
mainfrom
fix/cip-4104-tokio-postgres-patch
Open

tobyhede wants to merge 1 commit into
mainfrom
fix/cip-4104-tokio-postgres-patch

Conversation

@tobyhede

Copy link
Copy Markdown
Contributor

Summary

Bumps tokio-postgres in Cargo.lock from 0.7.13 → 0.7.18 to address GHSA-3gjw-f78c-vvpw (Medium; affected >= 0.4.0, < 0.7.18). Resolves Dependabot alert #55.

Lockfile-only change; no Cargo.toml edits (all manifests already use tokio-postgres = "0.7").

Lockfile changes

  • tokio-postgres 0.7.13 → 0.7.18
  • Companion/transitive bumps pulled in by the resolver: postgres-types 0.2.9 → 0.2.14, postgres-derive 0.4.6 → 0.4.9, whoami 1.6.0 → 2.1.3, wasite 0.1.0 → 1.0.2, phf/phf_shared 0.11.3 → 0.13.1, serde_json 1.0.140 → 1.0.151; added objc2-core-foundation, objc2-system-configuration, zmij
  • libredox 0.1.3 → 0.1.24 (required: whoami 2.x needs a newer libredox than was locked)
  • postgres-protocol (0.6.12) and tokio-postgres-rustls (0.13.0) unchanged

Verification

  • cargo tree -i tokio-postgres --workspace: single version, tokio-postgres v0.7.18
  • cargo check --workspace --all-targets: passes

Addresses GHSA-3gjw-f78c-vvpw (affected >= 0.4.0, < 0.7.18).
Lockfile-only change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant