Cargo: update clap from 2 to 4

Update clap from 2.34.0 to 4.4.6, because clap both 2 and 3 rely on a unmaintained lib atty, which causes security issues. https://github.com/flatcar/update-ssh-keys/security/dependabot/3 To do that, it is required to turn on `cargo` features of clap, because clap 4 does not expose macros like clap_version by default.
flatcar · Oct 24, 2023 · 860e7e6 · 860e7e6
1 parent cfabe0e
commit 860e7e6
Show file tree

Hide file tree

Showing 2 changed files with 136 additions and 55 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -9,13 +9,12 @@ description = "A tool for managing authorized SSH keys"
 version = "0.4.2-alpha.0"
 
 [dependencies]
-# Private dependencies.
-clap = "2.33"
 fs2 = "0.4"
 # Public dependencies, exposed through library API.
 error-chain = { version = "0.12", default-features = false }
 openssh-keys = { git = "https://github.com/pothos/openssh-keys", branch = "add-sk-keys" }
 users = "0.9"
+clap = { version = "4.4.6", features = ["cargo"] }
 
 [[bin]]
 name = "update-ssh-keys"