Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rust-analyzer depends on anymap 1.0.0-beta.2 #15500

Closed
gigaroby opened this issue Aug 22, 2023 · 5 comments
Closed

Rust-analyzer depends on anymap 1.0.0-beta.2 #15500

gigaroby opened this issue Aug 22, 2023 · 5 comments
Labels
C-enhancement Category: enhancement E-easy

Comments

@gigaroby
Copy link
Contributor

This appears to be unmaintained and contain soundness issues: https://rustsec.org/advisories/RUSTSEC-2021-0065.html.

See also chris-morgan/anymap#37
@gigaroby gigaroby added the C-bug Category: bug label Aug 22, 2023
@lnicola
Copy link
Member

lnicola commented Aug 22, 2023

Looks like the soundness issue was fixed in the version we're using. It might be nice to move off anymap, but it doesn't seem terribly urgent.

@Veykril
Copy link
Member

Veykril commented Aug 22, 2023

We should move off of it I think, it's easy enough to self implement this, especially since we don't need the entire API surface either

@Veykril Veykril added E-easy C-enhancement Category: enhancement and removed C-bug Category: bug labels Aug 22, 2023
@shogo-nakano-desu
Copy link
Contributor

Hi, can I try to work on this issue?

@lnicola
Copy link
Member

lnicola commented Sep 15, 2023

@shogo-nakano-desu go ahead!

@shogo-nakano-desu shogo-nakano-desu mentioned this issue Sep 16, 2023
Merged
bors added a commit that referenced this issue Oct 9, 2023
@bors
Auto merge of #15618 - shogo-nakano-desu:internal/port-anymap, r=Veykril
aaa1e8e 
internal: port anymap

## Description
- The anymap crate has been ported. During this process, unnecessary features for rust-analyzer have been removed.
- From the tests that were checking the existing licenses, the anymap license (`BlueOak-1.0.0 OR MIT OR Apache-2.0`) has been removed.

## Requests
- While porting the code this time, I have tried to respect the original author's intentions and have kept the comments/codes as much as possible. Please don't hesitate to tell me if you think the comments/codes also need to be appropriately modified.
- If there are any necessary changes regarding the licensing or anything else, please let me know so I can fix them.

## Issue
#15500
@lnicola
Copy link
Member

lnicola commented Oct 16, 2023 •
edited
Loading

Port added in #15618.

Now we're not going to know about any anymap CVEs, but they're still going to affect us 😬.

@lnicola lnicola closed this as completed Oct 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C-enhancement Category: enhancement E-easy
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@lnicola @gigaroby @Veykril @shogo-nakano-desu