console icon indicating copy to clipboard operation
console copied to clipboard

chore: get rid of remove_dir_all

Open 0xPoe opened this issue 1 year ago • 1 comments

close https://github.com/tokio-rs/console/pull/539

See https://github.com/advisories/GHSA-mc8h-8q98-g5hr

console on  rustin-patch-remove_dir-with-1.70.0 [$] via 🦀 v1.74.0 
❯ cargo tree -i remove_dir_all
error: package ID specification `remove_dir_all` did not match any packages

0xPoe avatar Apr 09 '24 15:04 0xPoe

It would be nice to avoid the MSRV bump --- is the clap dependency update necessary?

As you can tell from the dependency tree:

❯ cargo tree -i remove_dir_all
remove_dir_all v0.5.3
└── tempfile v3.3.0
    ├── prost-build v0.12.0
    │   └── tonic-build v0.10.0
    │       └── xtask v0.1.0 (/Users/joshka/local/tokio-console/xtask)
    │       [dev-dependencies]
    │       └── console-api v0.6.0 (/Users/joshka/local/tokio-console/console-api)
    │           ├── console-subscriber v0.2.0 (/Users/joshka/local/tokio-console/console-subscriber)
    │           └── tokio-console v0.1.10 (/Users/joshka/local/tokio-console/tokio-console)
    │   [dev-dependencies]
    │   └── console-api v0.6.0 (/Users/joshka/local/tokio-console/console-api) (*)
    └── snapbox v0.5.9
        └── trycmd v0.15.1
            [dev-dependencies]
            └── tokio-console v0.1.10 (/Users/joshka/local/tokio-console/tokio-console)

If we want to get rid of the remove_dir_all then we need to bump the tempfile. But if we try to bump it directly, we will get an error:

❯ cargo update -p tempfile --precise 3.10.1
    Updating crates.io index
error: failed to select a version for `rustix`.
    ... required by package `tempfile v3.10.1`
    ... which satisfies dependency `tempfile = "^3"` of package `prost-build v0.12.0`
    ... which satisfies dependency `prost-build = "^0.12.0"` (locked to 0.12.0) of package `console-api v0.6.0 (/Volumes/t7/code/console/console-api)`
    ... which satisfies path dependency `console-api` (locked to 0.6.0) of package `console-subscriber v0.2.0 (/Volumes/t7/code/console/console-subscriber)`
versions that meet the requirements `^0.38.31` are: 0.38.32, 0.38.31

all possible versions conflict with previously selected packages.

  previously selected package `rustix v0.38.15`
    ... which satisfies dependency `rustix = "^0.38.0"` (locked to 0.38.15) of package `is-terminal v0.4.9`
    ... which satisfies dependency `is-terminal = "^0.4.1"` (locked to 0.4.9) of package `clap_builder v4.1.14`
    ... which satisfies dependency `clap_builder = "=4.1.14"` (locked to 4.1.14) of package `clap v4.1.14`
    ... which satisfies dependency `clap = "~4.1.14"` (locked to 4.1.14) of package `tokio-console v0.1.10 (/Volumes/t7/code/console/tokio-console)`

failed to select a version for `rustix` which could resolve this conflict

So before we bump the tempfile, we have to bump the clap to use the higher version rustix.

0xPoe avatar Apr 10 '24 13:04 0xPoe

There seem to be a lot of new transient dependencies added as part of this change.

Is it possible to make the change without doing this?

You can refer to https://github.com/tokio-rs/console/pull/542#issuecomment-2047507319

But I think we can split them into two PRs. But the change would be the same.

0xPoe avatar May 16 '24 13:05 0xPoe

But I think we can split them into two PRs. But the change would be the same.

Split: https://github.com/tokio-rs/console/pull/552

0xPoe avatar May 16 '24 13:05 0xPoe

Thanks for your review! 💚 💙 💜 💛 ❤️

0xPoe avatar May 16 '24 14:05 0xPoe