rusty-tags
rusty-tags copied to clipboard
`cargo audit` warnings due to stale clap dependency
Thanks for publishing this tool! I'm looking forward to using it, but am somewhat concerned by the following cargo audit reported issues:
# cargo audit
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
...
Scanning Cargo.lock for vulnerabilities (56 crate dependencies)
Crate: ansi_term
Version: 0.12.1
Warning: unmaintained
Title: ansi_term is Unmaintained
Date: 2021-08-18
ID: RUSTSEC-2021-0139
URL: https://rustsec.org/advisories/RUSTSEC-2021-0139
Dependency tree:
ansi_term 0.12.1
└── clap 2.34.0ansi_term
└── rusty-tags 3.11.0
Crate: atty
Version: 0.2.14
Warning: unmaintained
Title: `atty` is unmaintained
Date: 2024-09-25
ID: RUSTSEC-2024-0375
URL: https://rustsec.org/advisories/RUSTSEC-2024-0375
Dependency tree:
atty 0.2.14
└── clap 2.34.0
└── rusty-tags 3.11.0
Crate: atty
Version: 0.2.14
Warning: unsound
Title: Potential unaligned read
Date: 2021-07-04
ID: RUSTSEC-2021-0145
URL: https://rustsec.org/advisories/RUSTSEC-2021-0145
warning: 3 allowed warnings found
It looks as though they're all due to the somewhat stale clap dependency. clap appears to have dropped atty and ansi_term via commits aaac3c4930a045639c9dd419e7dd7455cda8d597 and 070bd50b285ab59236464668a9d99414a6ab9270 respectively. Dropping clap completely would be a viable alternative to upgrading, as it drags in quite a few dependencies.