RUSTSEC-2020-0016: net2 crate has been deprecated; use socket2 instead

[github-actions]

net2 crate has been deprecated; use socket2 instead

Details
Status	unmaintained
Package	net2
Version	0.2.34
URL	deprecrated/net2-rs@3350e38
Date	2020-05-01

The net2 crate has been deprecated
and users are encouraged to considered socket2 instead.

See advisory page for additional details.

[Nemo157]

This is coming in from hyper (hyperium/hyper#2205) and mio (no upstream issue yet).

[Nemo157]

mio v0.7 has moved net2 to be just a dev-dependency, presumably this will be included with tokio v0.3 which is currently ~2 months past its expected release.

[jyn514]

We still have this in our dependency tree through notify.

$ cargo tree -i net2
net2 v0.2.37
└── mio v0.6.23
    ├── mio-extras v2.0.6
    │   └── notify v4.0.15
    │       └── docs-rs v0.6.0 (/home/joshua/src/rust/docs.rs)
    └── notify v4.0.15 (*)

[jyn514]

It looks like this will be fixed in notify 5.0: https://github.com/notify-rs/notify/blob/4a3f5a35d15dbed5611732016f90c785fdf0f0ac/Cargo.toml#L35

[syphar]

cargo tree -i net2 is empty now.

[syphar]

cargo audit still returns net2 and it's also in cargo.lock. looking further

[jyn514]

@syphar maybe it's platform dependent? There's probably some flag we can pass to audit to tell it to only look at Linux.

[syphar]

I think audit is correct here,
only my cargo tree -i net2 call needs --target to provide the right output

[syphar]

closing #1963 is merged