Rocket: Cargo Audit Dependencies

[Turakar]

Rocket seems to be using outdated dependencies. This leads to two "security" problems found by cargo-audit:

$ cargo audit
[...]
warning: 1 warning found

Crate:  block-cipher-trait
Title:  crate has been renamed to `block-cipher`
Date:   2020-05-26
URL:    https://rustsec.org/advisories/RUSTSEC-2020-0018
Dependency tree: 
block-cipher-trait 0.6.2
├── aesni 0.6.0
│   └── aes 0.3.2
│       └── aes-gcm 0.5.0
│           └── cookie 0.11.3
│               └── rocket_http 0.4.5
│                   ├── rocket_codegen 0.4.5
│                   │   └── rocket 0.4.5
│                   │       ├── rocket_contrib 0.4.5
│                   │       │   └── my-lovely-crate x.x.x
│                   │       └── my-lovely-crate x.x.x
│                   └── rocket 0.4.5
├── aes-soft 0.3.3
│   └── aes 0.3.2
├── aes-gcm 0.5.0
└── aes 0.3.2

Crate:  net2
Title:  `net2` crate has been deprecated; use `socket2` instead
Date:   2020-05-01
URL:    https://rustsec.org/advisories/RUSTSEC-2020-0016
Dependency tree: 
net2 0.2.35
├── miow 0.2.1
│   └── mio 0.6.22
│       ├── notify 4.0.15
│       │   └── rocket_contrib 0.4.5
│       │       └── my-lovely-crate x.x.x
│       └── mio-extras 2.0.6
│           └── notify 4.0.15
└── mio 0.6.22

warning: 1 warning found!

However, the new versions do not only change patch level, but may contain breaking changes.
Maybe some kind of CI check would be helpful, e.g. using cargo-audit or even cargo-deny.

Rocket version: 0.4.5 (latest as of writing)
OS: Linux

[igalic]

a lot of dependencies have been updated recently, can you run this check against the master branch, too?

[hpodhaisky]

The first is gone, but the second is still there (in rocket 0.5.0-dev):

warning: 1 warning found

Crate: net2
Title: net2 crate has been deprecated; use socket2 instead
Date: 2020-05-01
URL: https://rustsec.org/advisories/RUSTSEC-2020-0016

[SergioBenitez]

net2 is a dependency of mio which itself is a dependency of tokio; there is nothing we can do to remove our transitive dependency outside of not depending on hyper or tokio. As such, I'm closing this issue. I would suggest raising this issue in the appropriate issue tracker, mio's.

[Turakar]

Sorry, my fault. In fact, the problem is that notify did not update to mio 0.7 yet due to the deprecation of mio-extras. I linked the corresponding issue.