RUSTSEC-2024-0375: `atty` is unmaintained

[github-actions[bot]]

atty is unmaintained

Details
Status	unmaintained
Package	atty
Version	0.2.14
URL	https://github.com/softprops/atty/issues/57
Date	2024-09-25

The maintainer of atty has published an official notice that the crate is no longer under development, and that users should instead rely on the functionality in the standard library's IsTerminal trait.

Alternative(s)

• std::io::IsTerminal - Stable since Rust 1.70.0 and the recommended replacement per the atty maintainer.
• is-terminal - Standalone crate supporting Rust older than 1.70.0

See advisory page for additional details.

[DanielVoogsgerd]

I thought I would quickly tackle this one, I was wrong :sweat_smile:

The main user of atty is humanlog, this should be easily fixable.

Another user is an old version of clap v2. The matching cargo tree is:

atty v0.2.14
├── clap v2.34.0
│   └── workflow v0.3.0
│       └── deliberation v0.1.0 (https://github.com/epi-project/policy-reasoner#9dfd53b9)
│           ├── audit-logger v0.1.0 (https://github.com/epi-project/policy-reasoner#9dfd53b9)
│           │   ├── reasonerconn v0.1.0 (https://github.com/epi-project/policy-reasoner#9dfd53b9)
│           │   │   └── srv v0.1.0 (https://github.com/epi-project/policy-reasoner#9dfd53b9)
│           │   │       └── brane-ctl v3.0.0 (https://github.com/epi-project/brane#8de160da)
│           │   │           └── key-manager v0.1.0 (<epi_dir>/policy-reasoner/fix/atty/tools/key-manager)

There are multiple problems with this dependency chain. ~First and foremost, the workflow crate repo has been deleted, I think it is fair to assume it is no longer maintained. I will open a separate issue for this one.~ I see this has already been resolved. I think it further highlights my second point, though. :laughing:

But I am also a bit unhappy with the tight coupling / circular dependency between Brane and policy reasoner here. I might be wrong, but I think it is problematic to have policy reasoner (or its tools) depend on Brane(ctl). Maybe it is good to split off these tools into a separate crate that can depend on both crates, but that is just a collection of these niceties.

I am curious what you think, I think/hope clearing these things up will long term help with the stability and maintainability of the ecosystem.