Ergonomic, hermetic, user-friendly software build system for Python, Go, Java, Kotlin, Protobuf, Scala, Shell. Pants lets you fearlessly scale up your codebase!

Pants

Wow. That's a potential biggie.
<https://blog.rust-lang.org/2023/01/10/cve-2022-46176.html>

... for some sad sap like me who recently converted Cargo to use ssh

"It was discovered that Cargo never implemented such checks"

Sounds like we should upgrade to Rust 1.66.1  asap

I just approved John's scie-pants request, which was how I learned about this :slightly_smiling_face:

But yeah, the "never implemented" blew my mind. I assumed it would have been a regression

<https://github.com/pantsbuild/pants/pull/17991>

why is this not implemented in the SSH library, relieving the application code of this responsibility? or does rust implement their own ssh library here?

:shrug:
<https://github.com/rust-lang/wg-security-response/blob/main/patches/CVE-2022-46176/0004-CVE-2022-46176-verify-ssh-host-keys-in-cargo.patch>

I rt'd it from the Pants account on Wednesday as well. <https://twitter.com/rustlang/status/1612851935366766593|https://twitter.com/rustlang/status/1612851935366766593>