1998421 - `paste` crate is no longer maintained

Status: NEW

(Core :: Graphics: WebGPU, defect)

Description

[Valentin Gosu [:valentin]]

While doing a mach vendor rust I got the following warning:

Advisory:
paste - no longer maintained
Package: paste
ID: RUSTSEC-2024-0436
Report date: 2024-10-07
The creator of the crate paste has stated in the [README.md](https://github.com/dtolnay/paste/blob/master/README.md)
that this project is not longer maintained as well as archived the repository
Possible Alternative(s)

    pastey, a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate

URL: https://github.com/dtolnay/paste
Advisory metadata: {

"aliases": [],
"related": [],
"collection": "crates",
"categories": [],
"keywords": [],
"informational": "unmaintained",
"references": [],
"source": null,
"withdrawn": null,
"license": "CC0-1.0"

}

Package info: {

"name": "paste",
"version": "1.0.11",
"source": "registry+https://github.com/rust-lang/crates.io-index",
"checksum": "d01a5bd0424d00070b0098dd17ebca6f961a959dead1dbcbbbc1d1cd8d3deeba",
"replace": null

}

According to cargo tree, paste is a dependency of application services via suggest > rmp-serde > paste

Comment 1

[Andy Leiserson [:aleiserson]]

paste is also used by wgpu, via metal and macro_rules_attribute. If the usage by application services is removed, consider reassigning this bug to the "Core :: Graphics - WebGPU" component.

I am adding a waiver in https://phabricator.services.mozilla.com/D273084.

Comment 2

[Mark Hammond [:markh] [:mhammond]]

https://github.com/mozilla/application-services/pull/7092 is removing it from a-s - I'll adjust the component once that lands.

Comment 3

[Mark Hammond [:markh] [:mhammond]]

https://github.com/mozilla/application-services/pull/7092 has landed, so adjusting component as per discussion above.

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit BugBot documentation.