concolor-control Archived; requires potentially insecure atty

[theory]

Looks like cargo-edit dependency concolor has been archived for over a year. It, in turn, depends on atty, which appears to be unmaintained and has a potential security issue (sample dependabot report.

Should concolor be removed or replaced with something that's maintained?

[epage]

With rust-lang/cargo#12425, I am treating cargo-edit as in maintenance mode and am doing the absolute minimum work on it, including for what PRs get reviewed.

[theory]

Thanks. I'm only interested in seeing security vulnerabilities addressed wherever possible. Whether or not it's worth it here presumably has to do with the timing of rust-lang/cargo#12425 as a replacement.

I suppose in the meantime I can just tell dependabot to STFU about atty.

[epage]

Why does dependabot care about cargo-edit dependencies?

[theory]

In this dependabot report, it says atty has a "potential unaligned read". That project depends on pgrx, which depends on cargo-edit, which depends on concolor, which depends on atty.

There are actually a few other paths to atty through pgrx; details in pgcentralfoundation/pgrx#1778.

[epage]

I can't access that dependabot report.

I'm going to guess you are depending on cargo-edit as a library? Why is that?

[theory]

I am not, but pgrx does. I don't know why.

[theory]

rust-lang/rustup#3443 has some information about the atty vulnerability.

[workingjubilee]

Because cargo-pgrx wants to update the files in Cargo.tomls for similar reasons in specific ways...?

[workingjubilee]

In practice, this is not at all a concern from the security perspective as we don't even support Windows much less use a custom allocator.

[epage]

So long as you know that for a while cargo-edit-the-lib is developed exclusively for cargo-edit-the-bin, semver is tracking the bins and not the libs, we are free to remove things as needed even if used by library users, and this has gone into deep maintenance mode as the functionality is moved into Cargo.

As this doesn't seem to be an issue, I'm closing this.