RUSTSEC-2024-0437 vulnerability with prometheus dependency

[srale]

Hi.
At the moment, poem depends on prometheus which in itself depends on protobuf, which has a vulnerability. This makes cargo audit fail without ignoring this vulnerability. This is the case because I'm using the prometheus feature in poem.

Link to the vulnerability: RUSTSEC-2024-0437.
Thank you!

[attila-lin]

wait this?

[vasra-gh]

@attila-lin yes

Dependency upgrade: Update protobuf to 3.7.2 for RUSTSEC-2024-0437

I guess just need to update dependencies on poem once that is merged

[vasra-gh]

Seems like opentelemetry-rust that poem uses which uses prometheus (which uses protobuf crate) won't be updated and will be discontinued. open-telemetry/opentelemetry-rust#2769

Will there a plan to replace it?