search

CosmWasm / cosmwasm

Framework for building smart contracts in Wasm for the Cosmos SDK
https://www.cosmwasm.com/
Apache License 2.0
1.06k stars 329 forks source link

Track unmaintained crates #1430

Open webmaster128 opened 1 year ago

webmaster128 commented 1 year ago

During CosmWasm development we published crates that are not safe for public consumtion. We should mard them as unmaintained somehow, e.g. in the RustSec Advisory Database. But first of all, let's get an overview.

Crate Source Note Done?
cosmwasm https://github.com/CosmWasm/cosmwasm/tree/0.7 Unmaintained; all versions yanked; RUSTSEC-2024-0004 ✅
cw-multi-threaded-cache https://github.com/CosmWasm/cw-tools Example code only; unmaintained; unused; yanked ✅
cw-module-size https://github.com/CosmWasm/cw-tools Example code only; unmaintained; unused; yanked ✅
cw-check-contract https://github.com/CosmWasm/cw-tools Unmaintained; unused; yanked
cw-storage https://github.com/CosmWasm/cw-storage Unmaintained; unused;
cw0 renamed to cw-utils (https://github.com/CosmWasm/cw-plus/pull/508)
webmaster128 commented 1 year ago

cw-multi-threaded-cache and cw-module-size are fully yanked now. Also cw-check-contract@1.0.0 is yanked and only the version with the deprecation note is still available.

@tom How did you create the deprecation note for cw-check-contract@1.0.1? Do you have that on some local branch of cw-tools you can share?

webmaster128 commented 1 year ago

cw-check-contract was not downloaded anymore. All versions if it are yanked now.

uint commented 1 year ago

@webmaster128 I've just archived cw-tools. Should we close this issue?

webmaster128 commented 1 year ago

What's left is doing something helpful with the very old cosmwasm crate. It is easy to be misused due to its name. Not sure how to best deal with that. Thoughts?

webmaster128 commented 8 months ago

Oh, there is also cw-storage.

I just yanked all versions of the cosmwasm crate and proposed an unmaintained entry in the RustSec Advisory Database .