Summary
mxd migrated to diesel-async 0.9 to clear Dependabot alerts 36/37/44
(GHSA-ff9q-rm55-q7qr; see PR #360). The published diesel-cte-ext 0.2.0
requires diesel-async ^0.7, so the workspace manifest temporarily pins
the dependency to a git revision of the upstream default branch, which
already targets diesel-async 0.9:
diesel-cte-ext = { git = "https://github.com/leynos/diesel-cte-ext", rev = "1457bb199adefd0ed368dfa9458fd4f07ae81679", default-features = false, features = ["async"] }The pinned revision is
1457bb19,
the head of leynos/diesel-cte-ext main at the time of pinning.
Action
Once a diesel-cte-ext release supporting diesel-async 0.9 is published
to crates.io, replace the git pin with a caret requirement (e.g.
diesel-cte-ext = { version = "^0.3", … }), refresh Cargo.lock, and
remove the TODO comment beside the pin in the workspace Cargo.toml.
Why it matters
Git pins bypass crates.io review, are invisible to Dependabot version
updates, and hold the dependency at a fixed commit that will silently
age. The pin exists only to bridge the gap until the upstream release.
Summary
mxdmigrated to diesel-async 0.9 to clear Dependabot alerts 36/37/44(GHSA-ff9q-rm55-q7qr; see PR #360). The published
diesel-cte-ext0.2.0requires diesel-async
^0.7, so the workspace manifest temporarily pinsthe dependency to a git revision of the upstream default branch, which
already targets diesel-async 0.9:
The pinned revision is
1457bb19,the head of
leynos/diesel-cte-extmainat the time of pinning.Action
Once a
diesel-cte-extrelease supporting diesel-async 0.9 is publishedto crates.io, replace the git pin with a caret requirement (e.g.
diesel-cte-ext = { version = "^0.3", … }), refreshCargo.lock, andremove the
TODOcomment beside the pin in the workspaceCargo.toml.Why it matters
Git pins bypass crates.io review, are invisible to Dependabot version
updates, and hold the dependency at a fixed commit that will silently
age. The pin exists only to bridge the gap until the upstream release.