Security Vulnerabilities

[c1ira]

@surpher Not sure this is the best place to ask, but would it be possible to connect privately (like via email) with you as a Maintainer to discuss remediating security vulnerabilities?

[surpher]

Hi @c1ira. Of course. I found your email in your public GitHub profile and will reach out.

[surpher]

Have had a close look at what the shared report was saying and realised all the vulnerabilities were to do with transient dependencies that are not controller or part of PactSwift. PactSwifts one and only dependency is pact-ffi. There were no reported vulnerabilities with Swift implementation in that report.

An issue has been raised for this to be addressed within reason here -> pact-foundation/pact-reference#192

Any vulnerabilities with transient dependencies that are not maintained by maintainers in the circle of Pact Foundation should be raised with the .crate in question owners/maintainers. Use the above shared link to the raised issue to track down the packages/crates that could benefit from dependency version updates.