Security warnings for oso 0.9.0 dependencies reported by `cargo audit` about oso HOT 3 OPEN

The issues if I understand correctly are about dependencies that are not actively maintained and presumably the parser is something that you have covered quite well with tests. Assuming that it doesn't, as a result of those dependencies, parse a "dangerous" input and do something terrible with it, and has no unsafe code with buffer overruns etc, and no such security advisories as I understand it exist today, then I guess it's okay.

from oso.

Thanks! I'll look into that today, and setup cargo audit in ci to catch future issues.

from oso.

Hey @ximon18. Thanks for reporting this! We've added cargo-audit to our CI in #647 and bumped some dependencies to address one of the issues. Some of the others are transitive dependencies of the lalrpop library that are only build-time dependencies for the parser generation.
The action has opened corresponding issues for them.

How critical would you consider these issues?

from oso.