server: Use forked validator crate

svix · Dec 17, 2024 · 19a656b · 19a656b
1 parent c7b455c
commit 19a656b
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 24 deletions.
diff --git a/deny.toml b/deny.toml
@@ -15,10 +15,6 @@ ignore = [
     "RUSTSEC-2023-0071",
     # TODO: Wait for dependencies to upgrade off of proc-macro-error
     "RUSTSEC-2024-0370",
-    # Doesn't affect us, we only use the vulnerable version through validator
-    # and don't use that for any sensitive auth checks.
-    # Details: https://github.com/svix/monorepo-private/issues/9541
-    "RUSTSEC-2024-0421",
 ]
 
 [licenses]

diff --git a/server/Cargo.lock b/server/Cargo.lock
diff --git a/server/svix-server/Cargo.toml b/server/svix-server/Cargo.toml
@@ -41,7 +41,10 @@ opentelemetry = { version = "0.23.0", features = ["metrics"] }
 opentelemetry_sdk = { version = "0.23.0", features = ["rt-tokio"] }
 opentelemetry-http = "0.12.0"
 opentelemetry-otlp = { version = "0.16.0", features = ["metrics"] }
-validator = { version = "0.16.0", features = ["derive"] }
+# Forked version of 0.16 with a small fix and dependency upgrades, since we
+# haven't gotten around to doing a proper upgrade yet (0.17 is a large
+# rewrite with a barely-useful changelog)
+validator = { git = "https://github.com/svix/validator.git", rev = "aebdc34a4ed72524902ff6d63397b9c435b0578f", features = ["derive"] }
 jwt-simple = "0.11.6"
 ed25519-compact = "2.1.1"
 chrono = { version="0.4.26", features = ["serde"] }