Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RUSTSEC-2019-0031: spin is no longer actively maintained #720

Closed
github-actions bot opened this issue Apr 16, 2020 · 3 comments · Fixed by #1110
Closed

RUSTSEC-2019-0031: spin is no longer actively maintained #720

github-actions bot opened this issue Apr 16, 2020 · 3 comments · Fixed by #1110
Labels
C-technical-debt Category: This makes the code harder to read and modify, but has no impact on end users E-easy Effort: Should be easy to implement and would make a good first PR

Comments

@github-actions
Copy link

spin is no longer actively maintained

Details
Status unmaintained
Package spin
Version 0.5.2
URL mvdnes/spin-rs@7516c80
Date 2019-11-21

The author of the spin crate does not have time or interest to maintain it.

Consider the following alternatives (both of which support no_std):

See advisory page for additional details.
@jyn514
Copy link
Member

jyn514 commented Apr 16, 2020 •
edited

Dependency tree:

spin 0.5.2
└── prometheus 0.7.0
    └── cratesfyi 0.6.0

Looks like this needs to be fixed upstream - the latest version of prometheus is 0.8 and they still depend on spin. See tikv/rust-prometheus#305

@Nemo157
Copy link
Member

Nemo157 commented Jun 1, 2020

Update, tikv/rust-prometheus#318 moved prometheus to parking_lot. But that is as of yet unreleased still.

@Nemo157 Nemo157 added the S-blocked Status: marked as blocked ❌ on something else such as an RFC or other implementation work. label Jun 1, 2020
@Nemo157 Nemo157 mentioned this issue Jul 1, 2020
Open
@conradgrobler conradgrobler mentioned this issue Jul 17, 2020
Closed
@Stupremee
Copy link
Member

The latest (0.10.0) prometheus version uses parking_lot

@jyn514 jyn514 added C-technical-debt Category: This makes the code harder to read and modify, but has no impact on end users E-easy Effort: Should be easy to implement and would make a good first PR and removed S-blocked Status: marked as blocked ❌ on something else such as an RFC or other implementation work. labels Sep 15, 2020
@jyn514 jyn514 mentioned this issue Oct 22, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C-technical-debt Category: This makes the code harder to read and modify, but has no impact on end users E-easy Effort: Should be easy to implement and would make a good first PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update prometheus, removing spin dependency jyn514/docs.rs
3 participants
@Nemo157 @jyn514 @Stupremee