RustCrypto
generic-array 0.x deprecation warnings
The crypto-common crate depends on [email protected] which was deprecated a couple of hours ago (see https://github.com/fizyk20/generic-array/commit/d859e59b29412c8434563716e418884c6a9266b2).
Should the dependency be updated to generic-array@1?
I noticed in some other places we migrated from generic-array to hybrid-array instead. Would that be a better direction?
In any case, I supposed this will require a breaking change release for the crypto-common crate and probably all crates depending on it too, since generic-array is used in the public API of the crypto-common crate.
/cc @tarcieri
We can not do anything on our side apart from releasing new crate versions which use hybrid-array. Also, see the generic-array issue: https://github.com/fizyk20/generic-array/issues/158
We can not do anything on our side apart from releasing new crate versions which use
hybrid-array.
yeah, that was my suggestion. is there a reason why we shouldn't do that?
There are some minor blockers which I would like to resolve before cutting new releases. Hopefully, it will be done before the year's end.
I believe that the best near-term solution would be to remove the deprecation warning from generic-array v0.14.
@newpavlov seems like we're going to get a lot of these. It would probably be good to wrap things up sooner than later
When can we expect the version that fixes this, and what will be its MSRV? This is currently breaking https://github.com/zip-rs/zip2, and I'm not prepared to make all other dependencies harder to update by removing Cargo.lock from .gitignore (which isn't recommended for libraries anyway).
We plan to release new versions before the year's end. MSRV will be equal to 1.85.
The easiest solution in the near term is to pin generic-array to v0.14.7 either by committing Cargo.lock (it works fine for libraries as you can see in our repos) or by adding generic-array = "=0.14.7" to your Cargo.toml. I know that the latter can be brittle and generally is not recommended, but it should work fine in this particular case.
Could a patch release of digest add the generic-array = "=0.14.7" pin to its Cargo.toml, so this doesn't need to be worked around (and then eventually un-worked-around) in every downstream crate?
Sounds plausible, possibly in crypto-common so it works for both cipher and digest
crypto-common v0.1.7 with pinned generic-array is released! Downstream users should be able to remove the pinning in their crates after cargo update.