Update url to min 2.5.4

[ericswpark]

This also resolves the security warning that comes from idna 0.5.0 being vulnerable.

[weihanglo]

While this looks legit, git2 doesn't pin the version of url crate. Packages depending on git2 should be able to get the latest url without problems.

What is the actual security warning from?

[ericswpark]

@weihanglo you're right. I initially received an update from Dependabot telling me one of my projects was vulnerable due to idna, and tracked down the dependency graph until I landed on git2. Dependabot couldn't create a patch automatically, so I assumed 2.0 on cargo.toml locked versions to 2.0.x. After running cargo update I can verify url is updated to 2.5.4.

I can edit the patch to say 2.5 instead of 2.5.4 so it goes up to the version before 3.x, or this PR can be closed if it is unnecessary.

[weihanglo]

I can edit the patch to say 2.5 instead of 2.5.4 so it goes up to the version before 3.x, or this PR can be closed if it is unnecessary.

Specifying url = "2.5.4" doesn't lock the dependency to 2.5.4 either. See https://doc.rust-lang.org/nightly/cargo/reference/specifying-dependencies.html#default-requirements.

[ericswpark]

I can edit the patch to say 2.5 instead of 2.5.4 so it goes up to the version before 3.x, or this PR can be closed if it is unnecessary.

Specifying url = "2.5.4" doesn't lock the dependency to 2.5.4 either. See doc.rust-lang.org/nightly/cargo/reference/specifying-dependencies.html#default-requirements.

@weihanglo thanks for the link, I assumed putting on the patch version would lock it to future patch releases (2.5.x), though it seems I would have to use tilde requirements for that.

[weihanglo]

To clarify, url = "2.0" has no problem for downstream users, as they will always get the latest 2.y.z version if they have no pre-existent Cargo.lock, or run cargo update.

Your original commit e31ba6a is a correct fix that downstream users will no longer get any version older than 2.5.4, moving the ecosystem away from the vulnerability. Could you also help update git2-curl and squash into one commit?

git2-rs/git2-curl/Cargo.toml

Line 17 in 7b7be43

url = "2.0"

[ericswpark]

@weihanglo sounds good, I've dropped the last commit and updated git2-curl as well.