Ignored RUSTSEC advisories

[ghost]

This issue will track this repo's ignored security advisories and why, to promote transparency in our work.

Commits editing the ignored advisories list:

• 9214a0d

Ignored advisories:

• RUSTSEC-2021-0124
  Upgrading tokio completely is not possible until grpc upgrades
• RUSTSEC-2021-0078
  Server-side only issue
• RUSTSEC-2021-0079
  Client is affected too, but we use hyper with reqwest to communicate with Zemu gRPC endpoint, which is normally done exclusively in a testing context, during development, thus we decided to ignore this advisory as is not critical to production environments.

Furthermore, to fix 2021-0078 and 2021-0079 upgrading reqwest and hyper would pull in tokio 1.x, which is not compatible with 0.2.x, leading to having to manage and run 2 separate executors, with potential incompatibilities with grpc.

🔗 zboto Link