Conversation

Question to #Rust or #security experts:

Seeing the recent vulnerability in #Cargo and the corresponding fix for it in #RustLang version 1.66.1, I was wondering:

Shouldn't this fix be _backported_ to other versions, too? Am I understanding semver wrong?

So, in my view, there should now also be a version 1.65.1, 1.64.1 and so on.

Otherwise, a lot of older versions (maybe all) stay vulnerable, no?

Post about 1.66.1:
https://blog.rust-lang.org/2023/01/10/Rust-1.66.1.html

#AskFedi #FollowerPower #LazyWeb #RustLang #SemVer