Current Release Version Uses A yanked version of slab + Cargo.toml and .lock discrepancies

[athomasstevens]

The current released version of iron-ssh is relying on a yanked version of slab v0.4.10 and it was yanked for a possible out of bounds read. Installing iroh-ssh at the time of making this issue requires --locked which forces the use of this yanked package.
GHSA-qx2v-8332-m4fv

[athomasstevens]

This might be a transitive dependency and this might turn into dependency hell to fix I will try to track it down and see if this is a lot of work to fix.

[athomasstevens]

So seems to be a transitive dependency from tokio not sure what sets it to 0.4.10 but you can explicitly define it in your Cargo.toml to the patched version v0.4.11 and the project builds and will pull in v0.4.12 why idk. Does the project still work fully idk. Sorry for this silly issue really enjoy the project wish you best of luck wish I had more time to contribute more.

[rustonbsd]

Hi @athomasstevens, I saw the same thing and was wondering why it is still building but I forgot to run cargo update ^^ thanks for the heads up.

I can see it doesn't build when all deps are actually used as defined in the Cargo.toml. This is broken and needs a fix.

I am glad you are enjoying iroh-ssh! and not silly at all

[rustonbsd]

Hi @athomasstevens , thanks again for mentioning it, it must have been in this broken state for anyone installing via cargo install iroh-ssh for a while now. I just published the new version to crates.io

this is fixed by #46