Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update pretty_env_logger version #188

Merged
merged 1 commit into from
Dec 3, 2024
Merged

Conversation

giladwolff
Copy link
Contributor

@giladwolff giladwolff commented Dec 3, 2024

Our internal build static analysis tool flagged a few issues with the atty dependency that is pulled by pretty_env_logger 0.4. Updating the dependency to the latest pretty_env_logger 0.5 drops the atty dependency and will eventually make our internal build happy.

This is a sample warning we are getting:

GHSA-g98v-hv3f-hcfr_atty

atty potential unaligned read
**source_type**: lockfile
**package_ecosystem**: crates.io
**vulnerabilitydetails**: On windows, `atty` dereferences a potentially unaligned pointer.

In practice however, the pointer won't be unaligned unless a custom global allocator is used.

In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.

# atty is Unmaintained

A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.

Last release of `atty` was almost 3 years ago.

## Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

- [std::io::IsTerminal](https://doc.rust-lang.org/stable/std/io/trait.IsTerminal.html) - Stable since Rust 1.70.0
- [is-terminal](https://crates.io/crates/is-terminal) - Standalone crate supporting Rust older than 1.70.0"

**vulnerabilitypackagepurl**: pkg:cargo/atty

@giladwolff giladwolff requested review from a team as code owners December 3, 2024 00:42
@CLAassistant
Copy link

CLAassistant commented Dec 3, 2024

CLA assistant check
All committers have signed the CLA.

@korniltsev korniltsev merged commit f97f6f9 into grafana:main Dec 3, 2024
26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants