ymgyt / syndicationd

A TUI Feed Viewer
https://docs.syndicationd.ymgyt.io
Apache License 2.0
100 stars 4 forks source link

Migrate from `byte-unit` due to RUSTSEC-2024-0370 #154

Open ymgyt opened 2 months ago

ymgyt commented 2 months ago

The transitive dependency proc-macro-error from byte-unit is no longer maintained. We need to either stop using byte-unit or wait for byte-unit to address this issue and update accordingly.

crate-audit> ++ command cargo audit -n -d /nix/store/ll7kcsxajcc9girvh9jkargs31gx6k92-source --ignore RUSTSEC-2024-0320
crate-audit>       Loaded 658 security advisories (from /nix/store/ll7kcsxajcc9girvh9jkargs31gx6k92-source)
crate-audit>     Scanning Cargo.lock for vulnerabilities (533 crate dependencies)
crate-audit> Crate:     proc-macro-error
crate-audit> Version:   1.0.4
crate-audit> Warning:   unmaintained
crate-audit> Title:     proc-macro-error is unmaintained
crate-audit> Date:      2024-09-01
crate-audit> ID:        RUSTSEC-2024-0370
crate-audit> URL:       https://rustsec.org/advisories/RUSTSEC-2024-0370
crate-audit> Dependency tree:
crate-audit> proc-macro-error 1.0.4
crate-audit> └── syn_derive 0.1.8
crate-audit>     └── borsh-derive 1.5.1
crate-audit>         └── borsh 1.5.1
crate-audit>             └── rust_decimal 1.36.0
crate-audit>                 └── byte-unit 5.1.4
crate-audit>                     └── synd-stdx 0.1.0
crate-audit>                         ├── synd-term 0.3.1
crate-audit>                         ├── synd-kvsd 0.1.0
crate-audit>                         └── synd-api 0.2.5
crate-audit>                             └── synd-term 0.3.1
ymgyt commented 2 months ago

https://github.com/ymgyt/syndicationd/commit/5f05695b4d12493f45635ba0b194057576c2306b