`ark-relations`: Security RUSTSEC-2025-0055 on `tracing-subscriber@0.2.0`

[storopoli]

We seen to be hitting RUSTSEC-2025-0055 on the latest tagged version (0.5.1) of ark-relations in crates.io.

Crate:     tracing-subscriber
Version:   0.2.25
Title:     Logging user input may result in poisoning logs with ANSI escape sequences
Date:      2025-08-29
ID:        RUSTSEC-2025-0055
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0055
Solution:  Upgrade to >=0.3.20
Dependency tree:
tracing-subscriber 0.2.25
└── ark-relations 0.5.1
<REDACTED for brevity>

The tagged 0.5.1 version in crates.io has tracing-subscriber bounds to ^0.2:

whereas the current master has a bound on ^0.3:

snark/Cargo.toml

Line 23 in 02fed63

tracing-subscriber = { version = "0.3", default-features = false }

Can you please tag a 0.5.2 version (or maybe 0.6.0) in crates.io with the current master?

[Pratyush]

Hi, thanks for the heads up; we will do a release for 0.6.0 shortly.

[storopoli]

Any news on this?

[storopoli]

Any news on this? @Pratyush

[storopoli]

Tagging @mmagician

[storopoli]

Any updates @Pratyush @mmagician ?

[storopoli]

Guys, any updates on the 0.6.0 release?
@Pratyush @mmagician @ValarDragon

[storopoli]

Guys come one this is a trivial release.
@Pratyush @mmagician @ValarDragon

[storopoli]

Gently ping it's more than 4 months since reporting this. It is already on master just tag a release on crates.io.

@Pratyush @mmagician @ValarDragon

[wojciechsromek]

+1 to follow up on the issue, please release the version with the fix 🙏

[koxu1996]

@Pratyush Will you accept PR with the dependency update?

[storopoli]

@Pratyush Will you accept PR with the dependency update?

It’s already updated on master we just need a new tag and a crates.io release. See my original issue description above.