Skip to content

Please update dependencies #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
nazar-pc opened this issue Feb 24, 2025 · 2 comments · Fixed by #359
Closed

Please update dependencies #330

nazar-pc opened this issue Feb 24, 2025 · 2 comments · Fixed by #359

Comments

@nazar-pc
Copy link

The dependencies used here are outdated and should be updated:

  • ring 0.16 is old and doesn't compile on some targets + results in duplicated dependencies been built for Substrate users
  • rustls 0.20 is also old and has known CVE attached to it, which while not applicable, requires active suppression and results in duplicated dependencies for Substrate users

The most frustrating thing is that we don't even use litep2p, it gets pulled with Substrate unconditionally and we have to struggle from this for no reason 😕

Please consider updating these ASAP and bump the version in Substrate accordingly
@nazar-pc nazar-pc mentioned this issue Feb 24, 2025
Merged
1 task
@nazar-pc
Copy link
Author

nazar-pc commented Mar 7, 2025

Another security advisory from ring 0.16 caused by litep2p: https://rustsec.org/advisories/RUSTSEC-2025-0009.html

@lexnv
Copy link
Collaborator

lexnv commented Mar 7, 2025

Hey Nazar! Apologies for the inconvenience, I will have a look at upgrading our dependencies soon!

@lexnv lexnv mentioned this issue Mar 13, 2025
Merged
lexnv added a commit that referenced this issue Mar 31, 2025
@lexnv
features: Move quic related dependencies under feature flag (#359)
f70b794 
The following crates are made optional, depending on the Quic feature
flag:
- ring
- rustls

This effectively ensures that litep2p is not leaking outdated
dependencies for experimental features (ie quic).

Closes: #330

cc @paritytech/networking

---------

Signed-off-by: Alexandru Vasile <[email protected]>
Imod7 pushed a commit that referenced this issue Apr 1, 2025
@lexnv @Imod7
features: Move quic related dependencies under feature flag (#359)
7ed96f0 
The following crates are made optional, depending on the Quic feature
flag:
- ring
- rustls

This effectively ensures that litep2p is not leaking outdated
dependencies for experimental features (ie quic).

Closes: #330

cc @paritytech/networking

---------

Signed-off-by: Alexandru Vasile <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

features: Move quic related dependencies under feature flag paritytech/litep2p
2 participants
@nazar-pc @lexnv