server: Use forked validator crate

Author: svix-jplatte

deny.toml

@@ -15,10 +15,6 @@ ignore = [
     "RUSTSEC-2023-0071",
     # TODO: Wait for dependencies to upgrade off of proc-macro-error
     "RUSTSEC-2024-0370",
-    # Doesn't affect us, we only use the vulnerable version through validator
-    # and don't use that for any sensitive auth checks.
-    # Details: https://github.com/svix/monorepo-private/issues/9541
-    "RUSTSEC-2024-0421",
 ]
 
 [licenses]

server/Cargo.lock

@@ -41,7 +41,10 @@ opentelemetry = { version = "0.23.0", features = ["metrics"] }
 opentelemetry_sdk = { version = "0.23.0", features = ["rt-tokio"] }
 opentelemetry-http = "0.12.0"
 opentelemetry-otlp = { version = "0.16.0", features = ["metrics"] }
-validator = { version = "0.16.0", features = ["derive"] }
+# Forked version of 0.16 with a small fix and dependency upgrades, since we
+# haven't gotten around to doing a proper upgrade yet (0.17 is a large
+# rewrite with a barely-useful changelog)
+validator = { git = "https://github.com/svix/validator.git", rev = "aebdc34a4ed72524902ff6d63397b9c435b0578f", features = ["derive"] }
 jwt-simple = "0.11.6"
 ed25519-compact = "2.1.1"
 chrono = { version="0.4.26", features = ["serde"] }