4 ms·
Only if that different version is a dependency of a dependency. Your own will never change.
by andrepd 10mo ago
Only if that different version is a dependency of a dependency. Your own will never change.
- brabel 10mo agoThat does not make the problem go away: now you'll have both versions in your dependency graph - hence you may be vulnerable to both version's CVEs.
- andrepd 10mo agoAny time you pull any code, be it `cargo add` or `apt install` or copy-pasting it in your own code, you become vulnerable to any issues present in that code. I'm unsure what your point is. The claim is just that `cargo add crate` is functionally identical to downloading a C++ header and keeping it in the same version, since in both cases the dependency will be pinned to that fixed version.