You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the process of addressing #876 all versions of zeroize_derive prior to 1.2 were yanked. Going from 1.1 to 1.2 raises the MSRV from 1.47 to 1.51. This puts projects that -for whatever reason- cannot or prefer not to raise their MSRV into a difficult position:
Continuing to use zeroize_derive 1.1 means using an insecure version of zeroize_derive.
Continuing to use zeroize_derive 1.1 means not being able to make releases of binary crates (as I understand crate.io's yank semantics).
Raising their MSRV to be able to use zeroize_derive 1.2 makes their project unsuitable for their target audience.
It would be great if you could publish a version 1.1.1 of zeroize_derive that fixes the security problem while keeping the MSRV constant.
The text was updated successfully, but these errors were encountered:
In the process of addressing #876 all versions of zeroize_derive prior to 1.2 were yanked. Going from 1.1 to 1.2 raises the MSRV from 1.47 to 1.51. This puts projects that -for whatever reason- cannot or prefer not to raise their MSRV into a difficult position:
It would be great if you could publish a version 1.1.1 of zeroize_derive that fixes the security problem while keeping the MSRV constant.
The text was updated successfully, but these errors were encountered: