Vulnerable to: RUSTSEC-2024-0370

[SchahinRohani]

Nativelink uses the proc-macro-error crate which is unmaintained for longer then 2 years.

Observed in Vulnerabilities: https://securityscorecards.dev/viewer/?uri=github.com/TraceMachina/nativelink

RUSTSEC-2024-0370

[aaronmondal]

This is pulled in by aws-smithy-protocol-test as a test-only dependency. As such it's not pretty in the vuln logs but (currently) doesn't affect runtime code.

The fix here would be to bump/change these dependencies in the AWS Rust SDK upstream (which initially seems surprisingly straightforward) or to remove our dependence on the affected crate (which initially seems like a nontrivial effort).

[SchahinRohani]

In aws-smithy-protocol-test, the dependency on assert-json-diff was originally set to ^1.1, which brought in extend as a dependency (^0.1.0). However, starting with assert-json-diff 2.0.2, extend is no longer required. Additionally, extend itself resolved this issue in version 1.2 by removing its dependency on proc-macro-error. So, updating either assert-json-diff to 2.0.2 or extend to 1.2+ will clear the vulnerability entirely

I have tried to update it, but it seems i can't get rid of the proc-macro-error...