Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please publish a patch release of zeroize_derive 1.1 that fixes #876 but keeps the MSRV constant #880

Closed
teythoon opened this issue Oct 7, 2021 · 2 comments · Fixed by #881

Comments

@teythoon
Copy link

teythoon commented Oct 7, 2021

In the process of addressing #876 all versions of zeroize_derive prior to 1.2 were yanked. Going from 1.1 to 1.2 raises the MSRV from 1.47 to 1.51. This puts projects that -for whatever reason- cannot or prefer not to raise their MSRV into a difficult position:

  • Continuing to use zeroize_derive 1.1 means using an insecure version of zeroize_derive.
  • Continuing to use zeroize_derive 1.1 means not being able to make releases of binary crates (as I understand crate.io's yank semantics).
  • Raising their MSRV to be able to use zeroize_derive 1.2 makes their project unsuitable for their target audience.

It would be great if you could publish a version 1.1.1 of zeroize_derive that fixes the security problem while keeping the MSRV constant.

@tony-iqlusion
Copy link
Member

I can try to backport this to an MSRV compatible release when I have some time

@teythoon
Copy link
Author

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants