ark-relations: Security RUSTSEC-2025-0055 on tracing-subscriber@0.2.0 #413
Description
We seen to be hitting RUSTSEC-2025-0055 on the latest tagged version (0.5.1) of ark-relations in crates.io.
Crate: tracing-subscriber
Version: 0.2.25
Title: Logging user input may result in poisoning logs with ANSI escape sequences
Date: 2025-08-29
ID: RUSTSEC-2025-0055
URL: https://rustsec.org/advisories/RUSTSEC-2025-0055
Solution: Upgrade to >=0.3.20
Dependency tree:
tracing-subscriber 0.2.25
└── ark-relations 0.5.1
<REDACTED for brevity>The tagged 0.5.1 version in crates.io has tracing-subscriber bounds to ^0.2:
whereas the current master has a bound on ^0.3:
Line 23 in 02fed63
Can you please tag a 0.5.2 version (or maybe 0.6.0) in crates.io with the current master?