search

TeXitoi / structopt

Parse command line arguments by defining a struct.
Other
2.7k stars 149 forks source link

Unmaintained dependencies #537

Closed jaskij closed 4 months ago

jaskij commented 4 months ago

I just ran an audit on a barely-maintained codebase (cargo-bitbake) which uses structopt. Turns out that clap v2.34.0 pulls in two unmaintained dependencies, ansi_term v0.12.1 and atty v0.2.14.

As this crate is on life support now, due to inclusion into clap proper, this brings up an issue: is it sane to expect an update on the clap side? Or formally retire this crate?

It has been over two years since clap 3 was released, and users had ample time to migrate, so IMO it is probably better to just move on. As an additional supporting argument, this problem with the dependencies has been around for 2+ years, and it seems was never reported.

epage commented 4 months ago

For support status for each clap release, see https://github.com/clap-rs/clap/blob/master/CONTRIBUTING.md#version-support-policy

jaskij commented 4 months ago

Thanks for the link. This probably is not an ecosystem-wide show stopper, there is a clear migration path, especially considering the great MSRV on 3.2.25.

TeXitoi commented 4 months ago

That would be a clap modification, so the issue should be there. So I close this issue.

And this update is unlikely to happen, so I think opening the clap issue should not be done. Of this is a concern, clap upgrade is the solution.