Comment 1 for bug 2000839

This bug was fixed in the package cargo - 0.66.0+ds1-1ubuntu1

---------------
cargo (0.66.0+ds1-1ubuntu1) lunar; urgency=medium

  * Merge from Debian unstable (LP: #2000839):
    Remaining changes:
    - Add an explicit mechanism to customize the vendoring process
    - d/p/proxy-skip-tests.patch: skip a test when there's a proxy configured
      to accommodate Ubuntu autopkgtest setup
    - d/p/i386-crossbuild-tests.patch: disable some failing tests for
      cross-building from i386
    - d/p/remove-badges.patch: remove badges from documentation for privacy
      reasons (refreshed)
    - autopkgtests: test on all arches on Ubuntu
    - d/control: update the Vcs fields to point to Launchpad
    - make_orig_multi.sh: fix orig tarball compression to xz on Ubuntu
    - Track vendored dependencies
    - Bump the libgit2-related crates to get libgit2 1.5.0 bindings
    - make_orig_multi.sh: only use xz for vendor orig tarball on Ubuntu
  * Update vendored sources information

cargo (0.66.0+ds1-1) unstable; urgency=medium

  [ Fabian Grünbichler ]
  * fix CVE-2022-46176 (Thanks Peter Green!)
  * repack vendored sources with required libgit2-sys/git2/git2-curl versions
  * update unsuspicious files

cargo (0.66.0-1) unstable; urgency=medium

  * new upstream version 0.66

  [ Blair Noctis ]
  * Update debcargo-conf.patch, unapply tempfile patch to match vendored
  * Refresh patches and remove upstream applied CVE patches
  * Patch test macro to work around qemu vfork bug when command not found

  [ Fabian Grünbichler ]
  * no longer pin git2/libgit2-sys
  * update debcargo-conf.patch (concolor, clap)
  * update unsuspicious files
  * d/control: depend on rustc 1.63
  * drop armel workaround

  [ Rob Shearman ]
  * d/control: update minimum cargo, rustc and libstd-rust-dev versions

 -- Simon Chopin <email address hidden> Tue, 17 Jan 2023 14:48:37 +0100