Bump regex from 1.5.4 to 1.5.5

[dependabot]

Bumps regex from 1.5.4 to 1.5.5.

Changelog

Sourced from regex's changelog.

1.5.5 (2022-03-08)

This releases fixes a security bug in the regex compiler. This bug permits a vector for a denial-of-service attack in cases where the regex being compiled is untrusted. There are no known problems where the regex is itself trusted, including in cases of untrusted haystacks.

• SECURITY #GHSA-m5pq-gvj9-9vr8: Fixes a bug in the regex compiler where empty sub-expressions subverted the existing mitigations in place to enforce a size limit on compiled regexes. The Rust Security Response WG published an advisory about this: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

Commits

• d130381 1.5.5
• ae70b41 security: fix denial-of-service bug in compiler
• b92ffd5 cargo: use SPDX license format
• f6e52da syntax: fix 'unused' warnings
• 5197f21 fuzz: do not use inherits in Cargo.toml
• 3662851 doc: fix typo
• 63ee669 syntax/doc: fix 'their' typo
• d6bc7a4 readme: remove broken badge
• bd74660 fuzz: try to fix build issue
• bd0a142 readme: fix badges
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sylvestre]

appveyor is failing on:

---- find::matchers::printf::tests::test_printf_symlinks stdout ----
thread 'find::matchers::printf::tests::test_printf_symlinks' panicked at 'assertion failed: `(left == right)`
  left: `["f f ", "l f abbbc", "l d subdir", "l N missing", "l ? abbbc/x"]`,
 right: `["f f ", "l f abbbc", "l d subdir", "l ? missing", "l ? abbbc/x"]`', src\find\matchers\printf.rs:1019:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
failures:
    find::matchers::printf::tests::test_printf_symlinks
test result: FAILED. 135 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.04s

[sylvestre]

@refi64 rings a bell?

[tavianator]

So this line should be getting hit:

findutils/src/find/matchers/printf.rs

Line 561 in 4cd4e4f

Err(e) if e.kind() == std::io::ErrorKind::NotFound => 'N',

But instead it's hitting:

findutils/src/find/matchers/printf.rs

Line 570 in 4cd4e4f

Err(_) => '?',

This only happens for the nightly Windows build, so I suspect there's a change in IO error mapping on Windows that has hit nightly.

[tavianator]

I suspect this is caused by rust-lang/rust#90955

[tavianator]

I tried on a Windows VM but couldn't reproduce the failure, even with exactly the same nightly as that AppVeyor build.

[refi64]

Strange, it seems like the original error wouldn't have been one touched by that PR, since it would have been ERROR_FILE_NOT_FOUND / ERROR_PATH_NOT_FOUND...

There are some other strange errors there too:

warning: could not load dep-graph from `\\?\C:\projects\findutils\target\debug\incremental\exec_unit_tests-3tyfh3pshf23t\s-g7qub0d20a-5ndg2j-working\dep-graph.bin`: The handle is invalid. (os error 6)

Could it be an issue on AppVeyor's end?

[tavianator]

Ah, the bug doesn't show up on Windows 10/11, only Windows 8 and below (including Windows Server 2012 R2 Datacenter I guess, what AppVeyor is running): rust-lang/rust#95154

[tavianator]

The latest nightly has that bug fixed, and it made my PR (#154) pass, so I assume this one would pass too if we re-ran it.

[codecov]

Codecov Report

Merging #153 (d58fb52) into main (fcb89d2) will increase coverage by 0.16%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main     #153      +/-   ##
==========================================
+ Coverage   53.39%   53.55%   +0.16%     
==========================================
  Files          28       28              
  Lines        4748     4748              
  Branches     1555     1555              
==========================================
+ Hits         2535     2543       +8     
  Misses       1667     1667              
+ Partials      546      538       -8     

Impacted Files	Coverage Δ
src/xargs/mod.rs	80.31% <0.00%> (+2.07%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fcb89d2...d58fb52. Read the comment docs.