Add axum-core DoS

[davidpdrsn]

No description provided.

[davidpdrsn]

Could the CI error be because it doesn't handle parsing rc versions like 0.3.0.rc.2?

[alex]

Looks like it, but I'm not familiar with that part of the code base. I'm hoping someone else who knows it better will chime in.

…

On Sun, Sep 11, 2022 at 11:59 AM David Pedersen ***@***.***> wrote: Could the CI error be because it doesn't handle parsing rc versions like 0.3.0.rc.2? — Reply to this email directly, view it on GitHub <#1417 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBBAWS5ACAC3ZWXNEELV5X6XFANCNFSM6AAAAAAQJ2I534> . You are receiving this because you commented.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.

[pinkforest]

The decision we ended up last month with was here: #1417 (comment)

patched = [">= 0.2.8, < 0.3.0-rc.1", ">= 0.3.0-rc.2"]

And it links to the issue on rustsec/rustsec we clarified the SemVer out: rustsec/rustsec#690 (comment)

Which reflects the (eventually) merged PR.

We discussed also in zulip re: this:
https://rust-lang.zulipchat.com/#narrow/stream/146229-wg-secure-code/topic/OSV.20pre-release.20SemVer.20handling/near/298416355

I'll TODO to document this properly.