spin is no longer actively maintained (RUSTSEC-2019-0031) about rage HOT 4 CLOSED

Ooh yes, I've been meaning to add cargo audit to the CI workflow. Thanks for the reminder! I've opened #44 to track progress.

Unfortunately there's nothing I can currently do about this dependency. I do not directly depend on spin, and the dependencies that pull it in transitively (lazy_static, ring etc.) have not updated to an alternative (I note that the advisory itself indicates that there is no alternative).

This issue will be closed whenever dependencies become available that result in spin being dropped as a transitive dependency (or if spin itself resumes being maintained).

from rage.

spin is maintained again!

from rage.

Yeah, I know. I tried to find wheather spin is really necessary, but haven't yet. I created this issue primarily to have it documented. Maybe I will take a look in a few days :-)

from rage.

Okay, so cargo-tree shows that ring is the only relevant dependency. (If I don't misinterpret cargo-tree's output.)

$ cargo tree
...
├── minreq v1.4.1
│   ├── rustls v0.16.0
│   │   ├── ring v0.16.9
│   │   │   ├── spin v0.5.2
...

spin in lazy_static is feature-gated and seems not to be used when building rage

# Cargo.toml in lazy_static

[features]
spin_no_std = ["spin"]

$ cargo tree --all-features
...
├── console v0.9.1
│   ├── clicolors-control v1.0.1
│   │   ├── lazy_static v1.4.0
│   │   │   └── spin v0.5.2

├── minreq v1.4.1
│   ├── rustls v0.16.0
│   │   ├── ring v0.16.9
│   │   │   ├── spin v0.5.2 (*)
...

There is also an issue which might be resolved soon briansmith/ring#921.

from rage.