Warnings

RUSTSEC-2024-0375

atty is unmaintained

Details
Status	unmaintained
Package	atty
Version	0.2.14
URL	softprops/atty#57
Date	2024-09-25

The maintainer of atty has published an official notice that the crate is no longer
under development, and that users should instead rely on the functionality in the standard library's IsTerminal trait.

Alternative(s)

• std::io::IsTerminal - Stable since Rust 1.70.0 and the recommended replacement per the atty maintainer.
• is-terminal - Standalone crate supporting Rust older than 1.70.0

RUSTSEC-2020-0036

failure is officially deprecated/unmaintained

Details
Status	unmaintained
Package	failure
Version	0.1.8
URL	rust-lang-deprecated/failure#347
Date	2020-05-02

The failure crate is officially end-of-life: it has been marked as deprecated
by the former maintainer, who has announced that there will be no updates or
maintenance work on it going forward.

The following are some suggested actively developed alternatives to switch to:

• anyhow
• eyre
• fehler
• snafu
• thiserror

RUSTSEC-2024-0436

paste - no longer maintained

Details
Status	unmaintained
Package	paste
Version	1.0.15
URL	https://github.com/dtolnay/paste
Date	2024-10-07

The creator of the crate paste has stated in the README.md
that this project is not longer maintained as well as archived the repository

Possible Alternative(s)

• pastey, a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate

RUSTSEC-2024-0370

proc-macro-error is unmaintained

Details
Status	unmaintained
Package	proc-macro-error
Version	1.0.4
URL	https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20
Date	2024-09-01

proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.

proc-macro-error also depends on syn 1.x, which may be bringing duplicate dependencies into dependant build trees.

Possible Alternative(s)

• manyhow
• proc-macro-error2
• proc-macro2-diagnostics

RUSTSEC-2021-0145

Potential unaligned read

Details
Status	unsound
Package	atty
Version	0.2.14
URL	softprops/atty#50
Date	2021-07-04

On windows, atty dereferences a potentially unaligned pointer.

In practice however, the pointer won't be unaligned unless a custom global allocator is used.

In particular, the System allocator on windows uses HeapAlloc, which guarantees a large enough alignment.

atty is Unmaintained

A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.

Last release of atty was almost 3 years ago.

Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

• std::io::IsTerminal - Stable since Rust 1.70.0
• is-terminal - Standalone crate supporting Rust older than 1.70.0

RUSTSEC-2019-0036

Type confusion if private_get_type_id is overridden

Details
Status	unsound
Package	failure
Version	0.1.8
URL	rust-lang-deprecated/failure#336
Date	2019-11-13

Safe Rust code can implement malfunctioning __private_get_type_id__ and cause
type confusion when downcasting, which is an undefined behavior.

Users who derive Fail trait are not affected.