{"action":"created","comment":{"url":"https://api.github.com/repos/rust-lang/rfcs/pulls/comments/80097760","pull_request_review_id":1194938,"id":80097760,"diff_hunk":"@@ -0,0 +1,259 @@\n+- Feature Name: security_advisories\n+- Start Date: 2016-08-24\n+- RFC PR: (leave this empty)\n+- Rust Issue: (leave this empty)\n+\n+# Summary\n+[summary]: #summary\n+\n+Crates.io should offer an API to release security advisories for crates. Cargo\n+should offer a new command for the same purpose and warn about vulnerable crate\n+versions during compilation.\n+\n+# Motivation\n+[motivation]: #motivation\n+\n+When compared to other ecosystems such as Python's, Rust's broader community\n+prefers many single-purpose crates over larger monoliths. This situation,\n+together with the strongly encouraged practice of pinning MINOR versions of\n+dependencies, slows down the propagation of critical security fixes.","path":"text/0000-security-advisories.md","position":null,"original_position":19,"commit_id":"495685525b40e2e64d688ec6c44a7fc4cb8dfd92","original_commit_id":"d8aedf2a8df8d0eb3c40fbb47e471584c2491cac","user":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"body":"I updated the text to concretely mention why pinning is encouraged. Note that I wrote \"version ranges\" (e.g. `^1.0.0`) as well.","created_at":"2016-09-22T17:50:22Z","updated_at":"2016-09-22T17:50:22Z","html_url":"https://github.com/rust-lang/rfcs/pull/1752#discussion_r80097760","pull_request_url":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752","_links":{"self":{"href":"https://api.github.com/repos/rust-lang/rfcs/pulls/comments/80097760"},"html":{"href":"https://github.com/rust-lang/rfcs/pull/1752#discussion_r80097760"},"pull_request":{"href":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752"}}},"pull_request":{"url":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752","id":85709476,"html_url":"https://github.com/rust-lang/rfcs/pull/1752","diff_url":"https://github.com/rust-lang/rfcs/pull/1752.diff","patch_url":"https://github.com/rust-lang/rfcs/pull/1752.patch","issue_url":"https://api.github.com/repos/rust-lang/rfcs/issues/1752","number":1752,"state":"open","locked":false,"title":"Security advisories in crates.io","user":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"body":"pre-RFC here: https://internals.rust-lang.org/t/pre-rfc-security-advisories-as-part-of-crates-io-metadata/4045","created_at":"2016-09-18T13:05:57Z","updated_at":"2016-09-22T17:50:22Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d67331581f1e7ccb1eee85b7ee175af9087eb904","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752/commits","review_comments_url":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752/comments","review_comment_url":"https://api.github.com/repos/rust-lang/rfcs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rust-lang/rfcs/issues/1752/comments","statuses_url":"https://api.github.com/repos/rust-lang/rfcs/statuses/495685525b40e2e64d688ec6c44a7fc4cb8dfd92","head":{"label":"untitaker:security-advisories","ref":"security-advisories","sha":"495685525b40e2e64d688ec6c44a7fc4cb8dfd92","user":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"repo":{"id":66495073,"name":"rfcs","full_name":"untitaker/rfcs","owner":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/untitaker/rfcs","description":"RFCs for changes to Rust","fork":true,"url":"https://api.github.com/repos/untitaker/rfcs","forks_url":"https://api.github.com/repos/untitaker/rfcs/forks","keys_url":"https://api.github.com/repos/untitaker/rfcs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/untitaker/rfcs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/untitaker/rfcs/teams","hooks_url":"https://api.github.com/repos/untitaker/rfcs/hooks","issue_events_url":"https://api.github.com/repos/untitaker/rfcs/issues/events{/number}","events_url":"https://api.github.com/repos/untitaker/rfcs/events","assignees_url":"https://api.github.com/repos/untitaker/rfcs/assignees{/user}","branches_url":"https://api.github.com/repos/untitaker/rfcs/branches{/branch}","tags_url":"https://api.github.com/repos/untitaker/rfcs/tags","blobs_url":"https://api.github.com/repos/untitaker/rfcs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/untitaker/rfcs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/untitaker/rfcs/git/refs{/sha}","trees_url":"https://api.github.com/repos/untitaker/rfcs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/untitaker/rfcs/statuses/{sha}","languages_url":"https://api.github.com/repos/untitaker/rfcs/languages","stargazers_url":"https://api.github.com/repos/untitaker/rfcs/stargazers","contributors_url":"https://api.github.com/repos/untitaker/rfcs/contributors","subscribers_url":"https://api.github.com/repos/untitaker/rfcs/subscribers","subscription_url":"https://api.github.com/repos/untitaker/rfcs/subscription","commits_url":"https://api.github.com/repos/untitaker/rfcs/commits{/sha}","git_commits_url":"https://api.github.com/repos/untitaker/rfcs/git/commits{/sha}","comments_url":"https://api.github.com/repos/untitaker/rfcs/comments{/number}","issue_comment_url":"https://api.github.com/repos/untitaker/rfcs/issues/comments{/number}","contents_url":"https://api.github.com/repos/untitaker/rfcs/contents/{+path}","compare_url":"https://api.github.com/repos/untitaker/rfcs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/untitaker/rfcs/merges","archive_url":"https://api.github.com/repos/untitaker/rfcs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/untitaker/rfcs/downloads","issues_url":"https://api.github.com/repos/untitaker/rfcs/issues{/number}","pulls_url":"https://api.github.com/repos/untitaker/rfcs/pulls{/number}","milestones_url":"https://api.github.com/repos/untitaker/rfcs/milestones{/number}","notifications_url":"https://api.github.com/repos/untitaker/rfcs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/untitaker/rfcs/labels{/name}","releases_url":"https://api.github.com/repos/untitaker/rfcs/releases{/id}","deployments_url":"https://api.github.com/repos/untitaker/rfcs/deployments","created_at":"2016-08-24T19:53:05Z","updated_at":"2016-08-24T08:26:49Z","pushed_at":"2016-09-22T17:49:28Z","git_url":"git://github.com/untitaker/rfcs.git","ssh_url":"git@github.com:untitaker/rfcs.git","clone_url":"https://github.com/untitaker/rfcs.git","svn_url":"https://github.com/untitaker/rfcs","homepage":"","size":3337,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rust-lang:master","ref":"master","sha":"1f5d3a9512ba08390a2226aa71a5fe9e277954fb","user":{"login":"rust-lang","id":5430905,"avatar_url":"https://avatars.githubusercontent.com/u/5430905?v=3","gravatar_id":"","url":"https://api.github.com/users/rust-lang","html_url":"https://github.com/rust-lang","followers_url":"https://api.github.com/users/rust-lang/followers","following_url":"https://api.github.com/users/rust-lang/following{/other_user}","gists_url":"https://api.github.com/users/rust-lang/gists{/gist_id}","starred_url":"https://api.github.com/users/rust-lang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rust-lang/subscriptions","organizations_url":"https://api.github.com/users/rust-lang/orgs","repos_url":"https://api.github.com/users/rust-lang/repos","events_url":"https://api.github.com/users/rust-lang/events{/privacy}","received_events_url":"https://api.github.com/users/rust-lang/received_events","type":"Organization","site_admin":false},"repo":{"id":17527989,"name":"rfcs","full_name":"rust-lang/rfcs","owner":{"login":"rust-lang","id":5430905,"avatar_url":"https://avatars.githubusercontent.com/u/5430905?v=3","gravatar_id":"","url":"https://api.github.com/users/rust-lang","html_url":"https://github.com/rust-lang","followers_url":"https://api.github.com/users/rust-lang/followers","following_url":"https://api.github.com/users/rust-lang/following{/other_user}","gists_url":"https://api.github.com/users/rust-lang/gists{/gist_id}","starred_url":"https://api.github.com/users/rust-lang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rust-lang/subscriptions","organizations_url":"https://api.github.com/users/rust-lang/orgs","repos_url":"https://api.github.com/users/rust-lang/repos","events_url":"https://api.github.com/users/rust-lang/events{/privacy}","received_events_url":"https://api.github.com/users/rust-lang/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rust-lang/rfcs","description":"RFCs for changes to Rust","fork":false,"url":"https://api.github.com/repos/rust-lang/rfcs","forks_url":"https://api.github.com/repos/rust-lang/rfcs/forks","keys_url":"https://api.github.com/repos/rust-lang/rfcs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rust-lang/rfcs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rust-lang/rfcs/teams","hooks_url":"https://api.github.com/repos/rust-lang/rfcs/hooks","issue_events_url":"https://api.github.com/repos/rust-lang/rfcs/issues/events{/number}","events_url":"https://api.github.com/repos/rust-lang/rfcs/events","assignees_url":"https://api.github.com/repos/rust-lang/rfcs/assignees{/user}","branches_url":"https://api.github.com/repos/rust-lang/rfcs/branches{/branch}","tags_url":"https://api.github.com/repos/rust-lang/rfcs/tags","blobs_url":"https://api.github.com/repos/rust-lang/rfcs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rust-lang/rfcs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rust-lang/rfcs/git/refs{/sha}","trees_url":"https://api.github.com/repos/rust-lang/rfcs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rust-lang/rfcs/statuses/{sha}","languages_url":"https://api.github.com/repos/rust-lang/rfcs/languages","stargazers_url":"https://api.github.com/repos/rust-lang/rfcs/stargazers","contributors_url":"https://api.github.com/repos/rust-lang/rfcs/contributors","subscribers_url":"https://api.github.com/repos/rust-lang/rfcs/subscribers","subscription_url":"https://api.github.com/repos/rust-lang/rfcs/subscription","commits_url":"https://api.github.com/repos/rust-lang/rfcs/commits{/sha}","git_commits_url":"https://api.github.com/repos/rust-lang/rfcs/git/commits{/sha}","comments_url":"https://api.github.com/repos/rust-lang/rfcs/comments{/number}","issue_comment_url":"https://api.github.com/repos/rust-lang/rfcs/issues/comments{/number}","contents_url":"https://api.github.com/repos/rust-lang/rfcs/contents/{+path}","compare_url":"https://api.github.com/repos/rust-lang/rfcs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rust-lang/rfcs/merges","archive_url":"https://api.github.com/repos/rust-lang/rfcs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rust-lang/rfcs/downloads","issues_url":"https://api.github.com/repos/rust-lang/rfcs/issues{/number}","pulls_url":"https://api.github.com/repos/rust-lang/rfcs/pulls{/number}","milestones_url":"https://api.github.com/repos/rust-lang/rfcs/milestones{/number}","notifications_url":"https://api.github.com/repos/rust-lang/rfcs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rust-lang/rfcs/labels{/name}","releases_url":"https://api.github.com/repos/rust-lang/rfcs/releases{/id}","deployments_url":"https://api.github.com/repos/rust-lang/rfcs/deployments","created_at":"2014-03-07T21:29:00Z","updated_at":"2016-09-21T17:18:33Z","pushed_at":"2016-09-22T17:49:29Z","git_url":"git://github.com/rust-lang/rfcs.git","ssh_url":"git@github.com:rust-lang/rfcs.git","clone_url":"https://github.com/rust-lang/rfcs.git","svn_url":"https://github.com/rust-lang/rfcs","homepage":"","size":7755,"stargazers_count":742,"watchers_count":742,"language":null,"has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":351,"mirror_url":null,"open_issues_count":649,"forks":351,"open_issues":649,"watchers":742,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752"},"html":{"href":"https://github.com/rust-lang/rfcs/pull/1752"},"issue":{"href":"https://api.github.com/repos/rust-lang/rfcs/issues/1752"},"comments":{"href":"https://api.github.com/repos/rust-lang/rfcs/issues/1752/comments"},"review_comments":{"href":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752/comments"},"review_comment":{"href":"https://api.github.com/repos/rust-lang/rfcs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rust-lang/rfcs/pulls/1752/commits"},"statuses":{"href":"https://api.github.com/repos/rust-lang/rfcs/statuses/495685525b40e2e64d688ec6c44a7fc4cb8dfd92"}}}}
{"actor":{"display_login":"untitaker"}}