console
console copied to clipboard
chore: get rid of remove_dir_all
close https://github.com/tokio-rs/console/pull/539
See https://github.com/advisories/GHSA-mc8h-8q98-g5hr
console on rustin-patch-remove_dir-with-1.70.0 [$] via 🦀 v1.74.0
❯ cargo tree -i remove_dir_all
error: package ID specification `remove_dir_all` did not match any packages
It would be nice to avoid the MSRV bump --- is the
clapdependency update necessary?
As you can tell from the dependency tree:
❯ cargo tree -i remove_dir_all
remove_dir_all v0.5.3
└── tempfile v3.3.0
├── prost-build v0.12.0
│ └── tonic-build v0.10.0
│ └── xtask v0.1.0 (/Users/joshka/local/tokio-console/xtask)
│ [dev-dependencies]
│ └── console-api v0.6.0 (/Users/joshka/local/tokio-console/console-api)
│ ├── console-subscriber v0.2.0 (/Users/joshka/local/tokio-console/console-subscriber)
│ └── tokio-console v0.1.10 (/Users/joshka/local/tokio-console/tokio-console)
│ [dev-dependencies]
│ └── console-api v0.6.0 (/Users/joshka/local/tokio-console/console-api) (*)
└── snapbox v0.5.9
└── trycmd v0.15.1
[dev-dependencies]
└── tokio-console v0.1.10 (/Users/joshka/local/tokio-console/tokio-console)
If we want to get rid of the remove_dir_all then we need to bump the tempfile. But if we try to bump it directly, we will get an error:
❯ cargo update -p tempfile --precise 3.10.1
Updating crates.io index
error: failed to select a version for `rustix`.
... required by package `tempfile v3.10.1`
... which satisfies dependency `tempfile = "^3"` of package `prost-build v0.12.0`
... which satisfies dependency `prost-build = "^0.12.0"` (locked to 0.12.0) of package `console-api v0.6.0 (/Volumes/t7/code/console/console-api)`
... which satisfies path dependency `console-api` (locked to 0.6.0) of package `console-subscriber v0.2.0 (/Volumes/t7/code/console/console-subscriber)`
versions that meet the requirements `^0.38.31` are: 0.38.32, 0.38.31
all possible versions conflict with previously selected packages.
previously selected package `rustix v0.38.15`
... which satisfies dependency `rustix = "^0.38.0"` (locked to 0.38.15) of package `is-terminal v0.4.9`
... which satisfies dependency `is-terminal = "^0.4.1"` (locked to 0.4.9) of package `clap_builder v4.1.14`
... which satisfies dependency `clap_builder = "=4.1.14"` (locked to 4.1.14) of package `clap v4.1.14`
... which satisfies dependency `clap = "~4.1.14"` (locked to 4.1.14) of package `tokio-console v0.1.10 (/Volumes/t7/code/console/tokio-console)`
failed to select a version for `rustix` which could resolve this conflict
So before we bump the tempfile, we have to bump the clap to use the higher version rustix.
There seem to be a lot of new transient dependencies added as part of this change.
Is it possible to make the change without doing this?
You can refer to https://github.com/tokio-rs/console/pull/542#issuecomment-2047507319
But I think we can split them into two PRs. But the change would be the same.
But I think we can split them into two PRs. But the change would be the same.
Split: https://github.com/tokio-rs/console/pull/552
Thanks for your review! 💚 💙 💜 💛 ❤️