cargo_audit does not like brotli-sys about cramjam HOT 3 CLOSED

Thanks, I see that. It's what I meant as an alternative but haven't looked at the whole ecosystem since that was reported. Further, that was used in the first place because at the time of writing, the brotli crate looked more or less abandoned and/or was missing some features as I recall.

I'm away from my computer but rest assured this will be addressed. Thank you again for the thorough report.

from cramjam.

Thanks. As there is no patched version as of now, I suspect this won't be solved soon. I'll look more deeply into possible alternatives as time permits.

from cramjam.

From the advisory:

An updated version of brotli-sys has not been released. If one cannot update the C library, its authors recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

In Rust the issue can be mitigated by migrating to the brotli crate, which provides a Rust implementation of Brotli compression and decompression that is not affected by this issue.

from cramjam.