Thanks for #24, and for the quick turnaround on #23. main now reads cxx = "^1.0.138" / cxx-build = "^1.0.138", which is exactly what downstreams need.
The newest version on crates.io is still 0.18.3, and it carries the exact requirement:
$ curl https://index.crates.io/lb/ug/lbug # 2026-07-27
0.18.3 (latest) cxx =1.0.138, cxx-build =1.0.138
RUSTSEC-2026-0202 is patched in cxx >= 1.0.195. Until a release goes out carrying the caret, cargo update cannot move a downstream off 1.0.138, so the advisory has to stay in our audit config as an accepted exception with a written justification.
Is a release planned? There is no urgency on my side, since the advisory is unsound rather than a vulnerability and is not reachable from our code. I would just like to know whether to track a published version or the branch.
Thanks for #24, and for the quick turnaround on #23.
mainnow readscxx = "^1.0.138"/cxx-build = "^1.0.138", which is exactly what downstreams need.The newest version on crates.io is still 0.18.3, and it carries the exact requirement:
RUSTSEC-2026-0202 is patched in cxx >= 1.0.195. Until a release goes out carrying the caret,
cargo updatecannot move a downstream off 1.0.138, so the advisory has to stay in our audit config as an accepted exception with a written justification.Is a release planned? There is no urgency on my side, since the advisory is
unsoundrather than a vulnerability and is not reachable from our code. I would just like to know whether to track a published version or the branch.