Skip to content

Appease cargo-audit #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 6 commits into from
Closed

Appease cargo-audit #73

wants to merge 6 commits into from

Conversation

@genos
Copy link
Contributor

@genos genos commented Sep 22, 2025

Hello! And thanks for ascent, it's really interesting.

According to cargo-audit, and as mentioned in #65, there are a pair of unmaintained dependencies that trigger RUSTSEC warnings:

$ cargo audit

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 820 security advisories (from /Users/graham/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (107 crate dependencies)
Crate:     instant
Version:   0.1.13
Warning:   unmaintained
Title:     `instant` is unmaintained
Date:      2024-09-01
ID:        RUSTSEC-2024-0384
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0384
Dependency tree:
instant 0.1.13
└── ascent 0.8.0
    ├── ascent_macro 0.8.0
    │   └── ascent 0.8.0
    └── ascent-byods-rels 0.8.0

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── ascent_base 0.8.0
│   ├── ascent_macro 0.8.0
│   │   └── ascent 0.8.0
│   │       ├── ascent_macro 0.8.0
│   │       └── ascent-byods-rels 0.8.0
│   └── ascent 0.8.0
├── ascent-byods-rels 0.8.0
└── ascent 0.8.0

warning: 2 allowed warnings found

This tiny PR replaces instant with the recommended web-time and paste with its successor pastey.

@genos
Appease cargo-audit
55aa773 
Hello! And thanks for `ascent`, it's really interesting.

According to [`cargo-audit`](https://crates.io/crates/cargo-audit), and
as mentioned in #65, there are a pair of unmaintained dependencies that
trigger RUSTSEC warnings:

```
$ cargo audit

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 820 security advisories (from /Users/graham/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (107 crate dependencies)
Crate:     instant
Version:   0.1.13
Warning:   unmaintained
Title:     `instant` is unmaintained
Date:      2024-09-01
ID:        RUSTSEC-2024-0384
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0384
Dependency tree:
instant 0.1.13
└── ascent 0.8.0
    ├── ascent_macro 0.8.0
    │   └── ascent 0.8.0
    └── ascent-byods-rels 0.8.0

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── ascent_base 0.8.0
│   ├── ascent_macro 0.8.0
│   │   └── ascent 0.8.0
│   │       ├── ascent_macro 0.8.0
│   │       └── ascent-byods-rels 0.8.0
│   └── ascent 0.8.0
├── ascent-byods-rels 0.8.0
└── ascent 0.8.0

warning: 2 allowed warnings found
```

This tiny PR replaces `instant` with the recommended
[`web-time`](https://crates.io/crates/web-time) and
`paste` with its successor [`pastey`](https://crates.io/crates/pastey).
@genos genos mentioned this pull request Sep 22, 2025
Merged
s-arash
s-arash reviewed Sep 22, 2025
View reviewed changes
Copy link
Owner

@s-arash s-arash left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!

s-arash
s-arash reviewed Sep 22, 2025
View reviewed changes
.gitignore
Copy link
Owner

@s-arash s-arash Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove this one from the PR too!

Copy link
Contributor Author

@genos genos Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was a whitespace change, vim's :wq added a newline at the end

ascent_macro/src/scratchpad.rs
Copy link
Owner

@s-arash s-arash Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file needs to remain in the repo unchanged. Let's not delete it!

Copy link
Owner

@s-arash s-arash Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the CI errors for why!

Copy link
Contributor Author

@genos genos Sep 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, sorry! Already added it back in. I'm sure you weren't planning on this much open source babysitting today, my apologies.

@genos
Copy link
Contributor Author

genos commented Sep 22, 2025

Sorry, I've made such a hash of this one. I'll close this PR and open a cleaner version.

@genos genos closed this Sep 22, 2025
@genos genos deleted the appease-cargo-audit branch September 22, 2025 16:34
github-merge-queue bot pushed a commit to CQCL/hugr that referenced this pull request Sep 22, 2025
@genos
fix!: Appease cargo-audit by replacing unmaintained dependencies (#…
1099506 
…2572)

According to [`cargo-audit`](https://crates.io/crates/cargo-audit),
there are a few RUSTSEC advisories lurking in `hugr` due to unmaintained
dependencies:

- `fxhash`, both directly and transitively via `relrc`
- `instant`, transitively via `ascent`
- `paste`, both directly and transitively via `ascent`

This PR replaces local `fxhash` usage with the suggested
[`rustc-hash`](https://crates.io/crates/rustc-hash) and `paste` with the
successor [`pastey`](https://crates.io/crates/pastey).

**Of note:** switching to `rustc-hash` changed a couple of the testing
snapshots. I think everything is still in there, but the ordering has
shuffled a bit.

Of course, the transitive dependencies require updates to `ascent` and
`relrc`; see [this `ascent`](s-arash/ascent#73)
PR and [this `relrc`](lmondada/relrc#8) one.
If/when those get merged and released, we'd want to bump the versions of
those packages here, too.

<details>
<summary>Output of cargo audit</summary>

```
$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 820 security advisories (from /Users/graham/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (416 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Dependency tree:
fxhash 0.2.1
├── relrc 0.4.6
│   ├── hugr-persistent 0.2.3
│   │   └── hugr 0.22.3
│   │       ├── hugr-core 0.22.3
│   │       │   ├── hugr-persistent 0.2.3
│   │       │   ├── hugr-passes 0.22.3
│   │       │   │   └── hugr 0.22.3
│   │       │   ├── hugr-llvm 0.22.3
│   │       │   │   ├── hugr-llvm 0.22.3
│   │       │   │   └── hugr 0.22.3
│   │       │   └── hugr 0.22.3
│   │       └── hugr-cli 0.22.3
│   └── hugr-core 0.22.3
├── hugr-model 0.22.3
│   ├── hugr-py 0.1.0
│   ├── hugr-core 0.22.3
│   └── hugr 0.22.3
└── hugr-core 0.22.3

Crate:     instant
Version:   0.1.13
Warning:   unmaintained
Title:     `instant` is unmaintained
Date:      2024-09-01
ID:        RUSTSEC-2024-0384
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0384
Dependency tree:
instant 0.1.13
└── ascent 0.8.0
    └── hugr-passes 0.22.3
        └── hugr 0.22.3
            ├── hugr-core 0.22.3
            │   ├── hugr-persistent 0.2.3
            │   │   └── hugr 0.22.3
            │   ├── hugr-passes 0.22.3
            │   ├── hugr-llvm 0.22.3
            │   │   ├── hugr-llvm 0.22.3
            │   │   └── hugr 0.22.3
            │   └── hugr 0.22.3
            └── hugr-cli 0.22.3

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── hugr-py 0.1.0
├── hugr-passes 0.22.3
│   └── hugr 0.22.3
│       ├── hugr-core 0.22.3
│       │   ├── hugr-persistent 0.2.3
│       │   │   └── hugr 0.22.3
│       │   ├── hugr-passes 0.22.3
│       │   ├── hugr-llvm 0.22.3
│       │   │   ├── hugr-llvm 0.22.3
│       │   │   └── hugr 0.22.3
│       │   └── hugr 0.22.3
│       └── hugr-cli 0.22.3
├── hugr-core 0.22.3
├── ascent_base 0.8.0
│   ├── ascent_macro 0.8.0
│   │   └── ascent 0.8.0
│   │       └── hugr-passes 0.22.3
│   └── ascent 0.8.0
└── ascent 0.8.0

warning: 3 allowed warnings found
```

</details>

BREAKING CHANGE: replaced `fxhash` and `paste` with `rustc-hash` and
`pastey`, respectively.
@genos genos mentioned this pull request Sep 22, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@s-arash s-arash s-arash left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@genos @s-arash