Skip to content

Conversation

@kpreid
Copy link
Owner

@kpreid kpreid commented Mar 11, 2025

paste has been given an “unmaintained” advisory and that means, regardless of whether it is still any good, people will get warnings for having it in their transitive dependencies. I would like to avoid that.

Luckily, it turns out that we can just replace all of the token pasting with generic code. (Rust 1.79 added the num::NonZero<T> generic type, too, but that isn’t actually helping us because the ZeroablePrimitive trait it depends on is still unstable — so we still need to define separate concrete implementations.)

If a need for paste-like functionality comes up again, we can consider adding the functionality to our own exhaust-macros, look at what alternatives have developed by then, or see whether the RustSec policy has gained more nuance about “unmaintained” vs “done” status. But for now, this is one fewer dependency, quite cheaply, and less fuss.

`paste` has been given an “unmaintained” advisory and that means,
regardless of whether it is still any good, people will get warnings for
having it in their transitive dependencies. I would like to avoid that.

Luckily, it turns out that we can just replace all of the token pasting
with generic code. (Rust 1.79 added the `num::NonZero<T>` generic type,
too, but that isn’t actually helping us because the `ZeroablePrimitive`
trait it depends on is still unstable — so we still need to define
separate concrete implementations.)

If a need for `paste`-like functionality comes up again, we can consider
adding the functionality to our own `exhaust-macros`, look at what
alternatives have developed by then, or see whether the RustSec policy
has gained more nuance about “unmaintained” vs “done” status. But for
now, this is one fewer dependency, quite cheaply, and less fuss.
@kpreid kpreid added the dependencies Pull requests that update a dependency file label Mar 11, 2025
@kpreid kpreid merged commit 7d48dd6 into main Mar 11, 2025
11 checks passed
@kpreid kpreid deleted the paste branch March 11, 2025 03:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants