rusty-tags icon indicating copy to clipboard operation
rusty-tags copied to clipboard

`cargo audit` warnings due to stale clap dependency

Open ddiss opened this issue 2 months ago • 0 comments

Thanks for publishing this tool! I'm looking forward to using it, but am somewhat concerned by the following cargo audit reported issues:

# cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
...
    Scanning Cargo.lock for vulnerabilities (56 crate dependencies)
Crate:     ansi_term
Version:   0.12.1
Warning:   unmaintained
Title:     ansi_term is Unmaintained
Date:      2021-08-18
ID:        RUSTSEC-2021-0139
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0139
Dependency tree:
ansi_term 0.12.1
└── clap 2.34.0ansi_term
    └── rusty-tags 3.11.0

Crate:     atty
Version:   0.2.14
Warning:   unmaintained
Title:     `atty` is unmaintained
Date:      2024-09-25
ID:        RUSTSEC-2024-0375
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0375
Dependency tree:
atty 0.2.14
└── clap 2.34.0
    └── rusty-tags 3.11.0

Crate:     atty
Version:   0.2.14
Warning:   unsound
Title:     Potential unaligned read
Date:      2021-07-04
ID:        RUSTSEC-2021-0145
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0145

warning: 3 allowed warnings found

It looks as though they're all due to the somewhat stale clap dependency. clap appears to have dropped atty and ansi_term via commits aaac3c4930a045639c9dd419e7dd7455cda8d597 and 070bd50b285ab59236464668a9d99414a6ab9270 respectively. Dropping clap completely would be a viable alternative to upgrading, as it drags in quite a few dependencies.

ddiss avatar Nov 07 '25 05:11 ddiss