eclipse-zenoh / zenoh

zenoh unifies data in motion, data in-use, data at rest and computations. It carefully blends traditional pub/sub with geo-distributed storages, queries and computations, while retaining a level of time and space efficiency that is well beyond any of the mainstream stacks.
https://zenoh.io
Other
1.52k stars 161 forks source link

Dependency on `lockfree` an unmaintained and unsound crate #1563

Open VorpalBlade opened 1 month ago

VorpalBlade commented 1 month ago

Describe the bug

https://lib.rs/crates/zenoh-shm depends on https://lib.rs/crates/lockfree which is unmaintained and also unsound (using std::mem::uninitialized). I have tried reaching out to the author of the crate on their gitlab and plan to file an rustsec advisory when the 90 days are up (14th November).

As your reverse dependency is one of the more downloaded ones I thought I would give you a heads up so that you can switch to something else before then.

To reproduce

N/A

System info

N/A

fuzzypixelz commented 4 weeks ago

cc @yellowhatter