fix: replace vulnerable users crate with whoami
Code Quality / quality-checks (push) Has been cancelled
Security Scan / security-audit (push) Has been cancelled

The users crate (RUSTSEC-2025-0040) has an unfixable vulnerability.
Replace it with the maintained whoami crate for getting the current
username. Also remove metrics.yml workflow as it provided no value.
This commit is contained in:
2026-03-17 21:46:09 +01:00
parent c05d987ff1
commit aa59067bb3
4 changed files with 48 additions and 87 deletions
+2 -6
View File
@@ -4,7 +4,7 @@ use std::thread;
use log::{debug, error};
use pam_client::{Context, ErrorCode, Flag};
use smithay_client_toolkit::reexports::{calloop::channel, calloop::EventLoop};
use users::get_current_username;
use whoami::username;
use zeroize::Zeroizing;
const SERVICE_NAME: &str = "rustlock";
@@ -37,11 +37,7 @@ impl pam_client::ConversationHandler for LockConversation {
pub fn create_and_run_auth_loop(
) -> Option<(channel::Sender<Zeroizing<String>>, channel::Channel<bool>)> {
let username = get_current_username()
.expect("Failed to get username")
.to_str()
.expect("Failed to get non-unicode username")
.to_string();
let username = username();
let conversation = LockConversation { password: None };
match Context::new(SERVICE_NAME, Some(username.as_str()), conversation) {