3 ms·
Yanking releases which have bugs / vulnerabilities in them is very much not the norm in the Rust community. This is why projects like https://github.com/RustSe
by richardwhiuk 6y ago
Yanking releases which have bugs / vulnerabilities in them is very much not the norm in the Rust community.
This is why projects like https://github.com/RustSec https://github.com/RustSec exist.
- steveklabnik 6y agoI don't know about that, crates that RustSec has advisories for are often yanked, in my experience. Bugs? No. Security bugs? Yes.
- richardwhiuk 6y agoHyper 0.11.26 - https://crates.io/crates/hyper/0.11.26 https://crates.io/crates/hyper/0.11.26 Not yanked. Vulnerable to https://github.com/RustSec/advisory-db/blob/main/crates/hyper/RUSTSEC-2020-0008.md https://github.com/RustSec/advisory-db/blob/main/crates/hype...
- steveklabnik 6y agoSure, it's quite possible that not every single one ever is. One single version of one single library not being yanked doesn't mean that nobody ever does it.