iced icon indicating copy to clipboard operation
iced copied to clipboard
verified publisher icon iced-rs

cargo audit shows warning due to unmainted dependencies

Open SzilvasiPeter opened this issue 2 months ago • 2 comments

Is your issue REALLY a bug?

  • [x] My issue is indeed a bug!
  • [x] I am not crazy! I will not fill out this form just to ask a question or request a feature. Pinky promise.

Is there an existing issue for this?

  • [x] I have searched the existing issues.

Is this issue related to iced?

  • [x] My hardware is compatible and my graphics drivers are up-to-date.

What happened?

When running the cargo audit command, it shows five warning because of the unmaintained crates.

What is the expected behavior?

The library should use only maintained crates.

Version

master

Operating System

Linux

Do you have any log output?

$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 821 security advisories (from /home/pszilvasi/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (806 crate dependencies)
Crate:     atk-sys
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0416
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0416
Dependency tree:
atk-sys 0.18.2
└── gtk-sys 0.18.2
    └── rfd 0.13.0
        └── editor 0.1.0

Crate:     gdk-sys
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0418
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0418
Dependency tree:
gdk-sys 0.18.2
└── gtk-sys 0.18.2
    └── rfd 0.13.0
        └── editor 0.1.0

Crate:     gtk-sys
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0420
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0420
Dependency tree:
gtk-sys 0.18.2
└── rfd 0.13.0
    └── editor 0.1.0

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── rav1e 0.7.1
│   └── ravif 0.11.20
│       └── image 0.25.8
│           ├── screenshot 0.1.0
│           ├── markdown 0.1.0
│           ├── iced_graphics 0.14.0-dev
│           │   ├── iced_wgpu 0.14.0-dev
│           │   │   ├── integration 0.1.0
│           │   │   ├── iced_renderer 0.14.0-dev
│           │   │   │   ├── iced_widget 0.14.0-dev
│           │   │   │   │   ├── integration 0.1.0
│           │   │   │   │   ├── iced_tester 0.14.0-dev
│           │   │   │   │   │   └── iced 0.14.0-dev
│           │   │   │   │   │       ├── websocket 1.0.0
│           │   │   │   │   │       ├── vectorial_text 0.1.0
│           │   │   │   │   │       ├── url_handler 0.1.0
│           │   │   │   │   │       ├── tour 0.1.0
│           │   │   │   │   │       ├── tooltip 0.1.0
│           │   │   │   │   │       ├── todos 0.1.0
│           │   │   │   │   │       ├── toast 0.1.0
│           │   │   │   │   │       ├── the_matrix 0.1.0
│           │   │   │   │   │       ├── table 0.1.0
│           │   │   │   │   │       ├── system_information 0.1.0
│           │   │   │   │   │       ├── svg 0.1.0
│           │   │   │   │   │       ├── styling 0.1.0
│           │   │   │   │   │       ├── stopwatch 0.1.0
│           │   │   │   │   │       ├── solar_system 0.1.0
│           │   │   │   │   │       ├── slider 0.1.0
│           │   │   │   │   │       ├── sierpinski_triangle 0.1.0
│           │   │   │   │   │       ├── scrollable 0.1.0
│           │   │   │   │   │       ├── screenshot 0.1.0
│           │   │   │   │   │       ├── qr_code 0.1.0
│           │   │   │   │   │       ├── progress_bar 0.1.0
│           │   │   │   │   │       ├── pokedex 0.1.0
│           │   │   │   │   │       ├── pick_list 0.1.0
│           │   │   │   │   │       ├── pane_grid 0.1.0
│           │   │   │   │   │       ├── multitouch 0.1.0
│           │   │   │   │   │       ├── multi_window 0.1.0
│           │   │   │   │   │       ├── modal 0.1.0
│           │   │   │   │   │       ├── markdown 0.1.0
│           │   │   │   │   │       ├── loupe 0.1.0
│           │   │   │   │   │       ├── loading_spinners 0.1.0
│           │   │   │   │   │       ├── lazy 0.1.0
│           │   │   │   │   │       ├── layout 0.1.0
│           │   │   │   │   │       ├── gradient 0.1.0
│           │   │   │   │   │       ├── geometry 0.1.0
│           │   │   │   │   │       ├── game_of_life 0.1.0
│           │   │   │   │   │       ├── gallery 0.1.0
│           │   │   │   │   │       ├── ferris 0.1.0
│           │   │   │   │   │       ├── exit 0.1.0
│           │   │   │   │   │       ├── events 0.1.0
│           │   │   │   │   │       ├── editor 0.1.0
│           │   │   │   │   │       ├── download_progress 0.1.0
│           │   │   │   │   │       ├── delineate 0.1.0
│           │   │   │   │   │       ├── custom_widget 0.1.0
│           │   │   │   │   │       ├── custom_shader 0.1.0
│           │   │   │   │   │       ├── custom_quad 0.1.0
│           │   │   │   │   │       ├── counter 0.1.0
│           │   │   │   │   │       ├── combo_box 0.1.0
│           │   │   │   │   │       ├── color_palette 0.1.0
│           │   │   │   │   │       ├── clock 0.1.0
│           │   │   │   │   │       ├── checkbox 0.1.0
│           │   │   │   │   │       ├── changelog 0.1.0
│           │   │   │   │   │       ├── bezier_tool 0.1.0
│           │   │   │   │   │       └── arc 0.1.0
│           │   │   │   │   ├── iced_devtools 0.14.0-dev
│           │   │   │   │   │   └── iced 0.14.0-dev
│           │   │   │   │   └── iced 0.14.0-dev
│           │   │   │   ├── iced_test 0.14.0-dev
│           │   │   │   │   ├── todos 0.1.0
│           │   │   │   │   ├── styling 0.1.0
│           │   │   │   │   ├── iced_tester 0.14.0-dev
│           │   │   │   │   └── counter 0.1.0
│           │   │   │   └── iced 0.14.0-dev
│           │   │   └── iced 0.14.0-dev
│           │   ├── iced_tiny_skia 0.14.0-dev
│           │   │   └── iced_renderer 0.14.0-dev
│           │   ├── iced_renderer 0.14.0-dev
│           │   └── iced_program 0.14.0-dev
│           │       ├── iced_winit 0.14.0-dev
│           │       │   ├── integration 0.1.0
│           │       │   └── iced 0.14.0-dev
│           │       ├── iced_test 0.14.0-dev
│           │       └── iced_devtools 0.14.0-dev
│           ├── iced 0.14.0-dev
│           ├── gallery 0.1.0
│           └── custom_shader 0.1.0
└── metal 0.32.0
    └── wgpu-hal 26.0.4
        ├── wgpu-core-deps-windows-linux-android 26.0.0
        │   └── wgpu-core 26.0.1
        │       └── wgpu 26.0.1
        │           ├── iced_wgpu 0.14.0-dev
        │           └── cryoglyph 0.1.0
        │               └── iced_wgpu 0.14.0-dev
        ├── wgpu-core-deps-wasm 26.0.0
        │   └── wgpu-core 26.0.1
        ├── wgpu-core-deps-emscripten 26.0.0
        │   └── wgpu-core 26.0.1
        ├── wgpu-core-deps-apple 26.0.0
        │   └── wgpu-core 26.0.1
        ├── wgpu-core 26.0.1
        └── wgpu 26.0.1

Crate:     yaml-rust
Version:   0.4.5
Warning:   unmaintained
Title:     yaml-rust is unmaintained.
Date:      2024-03-20
ID:        RUSTSEC-2024-0320
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0320
Dependency tree:
yaml-rust 0.4.5
└── syntect 5.2.0
    └── iced_highlighter 0.14.0-dev
        ├── iced_widget 0.14.0-dev
        │   ├── integration 0.1.0
        │   ├── iced_tester 0.14.0-dev
        │   │   └── iced 0.14.0-dev
        │   │       ├── websocket 1.0.0
        │   │       ├── vectorial_text 0.1.0
        │   │       ├── url_handler 0.1.0
        │   │       ├── tour 0.1.0
        │   │       ├── tooltip 0.1.0
        │   │       ├── todos 0.1.0
        │   │       ├── toast 0.1.0
        │   │       ├── the_matrix 0.1.0
        │   │       ├── table 0.1.0
        │   │       ├── system_information 0.1.0
        │   │       ├── svg 0.1.0
        │   │       ├── styling 0.1.0
        │   │       ├── stopwatch 0.1.0
        │   │       ├── solar_system 0.1.0
        │   │       ├── slider 0.1.0
        │   │       ├── sierpinski_triangle 0.1.0
        │   │       ├── scrollable 0.1.0
        │   │       ├── screenshot 0.1.0
        │   │       ├── qr_code 0.1.0
        │   │       ├── progress_bar 0.1.0
        │   │       ├── pokedex 0.1.0
        │   │       ├── pick_list 0.1.0
        │   │       ├── pane_grid 0.1.0
        │   │       ├── multitouch 0.1.0
        │   │       ├── multi_window 0.1.0
        │   │       ├── modal 0.1.0
        │   │       ├── markdown 0.1.0
        │   │       ├── loupe 0.1.0
        │   │       ├── loading_spinners 0.1.0
        │   │       ├── lazy 0.1.0
        │   │       ├── layout 0.1.0
        │   │       ├── gradient 0.1.0
        │   │       ├── geometry 0.1.0
        │   │       ├── game_of_life 0.1.0
        │   │       ├── gallery 0.1.0
        │   │       ├── ferris 0.1.0
        │   │       ├── exit 0.1.0
        │   │       ├── events 0.1.0
        │   │       ├── editor 0.1.0
        │   │       ├── download_progress 0.1.0
        │   │       ├── delineate 0.1.0
        │   │       ├── custom_widget 0.1.0
        │   │       ├── custom_shader 0.1.0
        │   │       ├── custom_quad 0.1.0
        │   │       ├── counter 0.1.0
        │   │       ├── combo_box 0.1.0
        │   │       ├── color_palette 0.1.0
        │   │       ├── clock 0.1.0
        │   │       ├── checkbox 0.1.0
        │   │       ├── changelog 0.1.0
        │   │       ├── bezier_tool 0.1.0
        │   │       └── arc 0.1.0
        │   ├── iced_devtools 0.14.0-dev
        │   │   └── iced 0.14.0-dev
        │   └── iced 0.14.0-dev
        └── iced 0.14.0-dev

warning: 5 allowed warnings found

SzilvasiPeter avatar Oct 11 '25 18:10 SzilvasiPeter

Iced doesn't directly depend on any of these crates. Wouldn't it be more appropriate to report this to the crates that have these unmaintained crates as a direct dependency?

bradysimon avatar Oct 11 '25 18:10 bradysimon

The syntect warning (yaml-rust) seems to already be resolved and is planned for their next major release: https://github.com/trishume/syntect/pull/600

edwloef avatar Oct 12 '25 11:10 edwloef