Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace atty dependency in slog-term due to RUSTSEC-2021-0145 #319

Closed
willbuckner opened this issue Nov 23, 2022 · 5 comments · Fixed by slog-rs/term#45
Closed

Replace atty dependency in slog-term due to RUSTSEC-2021-0145 #319

willbuckner opened this issue Nov 23, 2022 · 5 comments · Fixed by slog-rs/term#45
Labels
C-bug Category: This is a bug. P-low Priority: Low

Comments

@willbuckner
Copy link

The title says it all, but there is an advisory for atty which is unmaintained, and this dependency likely needs to be replaced with something else. Advisory is here: https://rustsec.org/advisories/RUSTSEC-2021-0145.html

Thanks!

@dpc
Copy link
Collaborator

dpc commented Nov 24, 2022

So https://crates.io/crates/is-terminal ?

@Techcable Techcable added C-bug Category: This is a bug. P-low Priority: Low labels Nov 28, 2022
@Techcable
Copy link
Member

Hi! I fixed this in PR slog-rs/term#45

This doesn't look particularly important, so I'm not going to rush an emergency hotfix.

I will release it in the net batch of updates for term when I release v2.9.1.

This will probably come sometime in early December. I have one more week of classes and then finals.

@willbuckner
Copy link
Author

Looks great, thanks @Techcable! Looks like tests are failing due to:

Downloaded once_cell v1.16.0
error: failed to parse manifest at `/home/runner/.cargo/registry/src/github.aaakk.us.kg-1ecc6299db9ec823/once_cell-1.16.0/Cargo.toml`

Caused by:
  feature `edition[20](https://github.com/slog-rs/term/actions/runs/3562324356/jobs/5983962221#step:4:21)[21](https://github.com/slog-rs/term/actions/runs/3562324356/jobs/5983962221#step:4:22)` is required

  this Cargo does not support nightly features, but if you
  switch to nightly channel you can add
  `cargo-features = ["edition2021"]` to enable this feature
Error: Process completed with exit code 101.

As far as timeliness, December should be fine, but I will say that projects are having to allowlist this RUSTSEC in cargo-deny/cargo-audit rules until it's fixed. No big deal though, I have a tracking ticket internally to clean up the deny rules once this lands. Our project is not actually vulnerable due to this, it's just making cargo deny complain :)

@sunfishcode
Copy link

I added a comment to that PR explaining the test failures.

@gnaaman-dn
Copy link

If MSRV is ever raised to 1.70, this dependency can also be dropped in favour for std::io::IsTerminal

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C-bug Category: This is a bug. P-low Priority: Low
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants