Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RUSTSEC-2024-0384: Unmaintained transitive dependency #2554

Closed
turmanticant opened this issue Dec 6, 2024 · 1 comment · Fixed by #2557
Closed

RUSTSEC-2024-0384: Unmaintained transitive dependency #2554

turmanticant opened this issue Dec 6, 2024 · 1 comment · Fixed by #2557
Assignees

Comments

@turmanticant
Copy link

turmanticant commented Dec 6, 2024

Describe the bug

Hey! I use cargo-deny and noticed I was getting an error for one of tantivys transitive dependencies.

measure_time depends on instant which has been marked as unmaintained. There is no security vuln associated or anything requiring immediate action as best as I could tell.

There is only one place in tantivy I could see that uses measure_time, src/indexer/merger.rs.

It is importing the debug_time macro and using it to instrument a few methods.

        debug_time!("write-fast-fields");

Given the small usage here, could this replaced with a log::debug! and remove the dependency to measure_time? If so, I'm happy to open a PR doing that. 😀

Advisory:
https://rustsec.org/advisories/RUSTSEC-2024-0384

Which version of tantivy are you using?
0.22

To Reproduce

cargo deny check
@fulmicoton
Copy link
Collaborator

@PSeitz can you have a look?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants