Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more maintainers #160

Open
XVilka opened this issue May 27, 2020 · 11 comments
Open

Add more maintainers #160

XVilka opened this issue May 27, 2020 · 11 comments

Comments

@XVilka
Copy link
Contributor

XVilka commented May 27, 2020

It seems that you don't have time to maintain this repository. This crate is a "core" with a big count of downloads. Please consider adding more maintainers.
I sent two PRs modernizing the code:

@XVilka
Copy link
Contributor Author

XVilka commented May 29, 2020

cc @dtolnay

@dtolnay
Copy link
Collaborator

dtolnay commented May 29, 2020

Hi @XVilka, thanks for the PRs!

If you are interested in maintaining, I would recommend publishing your fork under a different crate name. I think the community would appreciate having a maintained fork; it doesn't have to be this repo.

@pksunkara
Copy link

We would use the fork in clap v2 if our security PR gets merged.

@CreepySkeleton
Copy link

@pksunkara No, we wouldn't. Switching to a fork would mean that Yaml types became different, exactly the reason we can't just bump it to yaml-rust 0.4.

I suggested to switch to a fork of yaml-rust clap 3.0 was because depending on something that's being maintained is way better than depending on something unmaintained.

@XVilka Are you looking forward to forking and maintaining the repo on you own? If not, I would go ahead and do that myself.

@XVilka
Copy link
Contributor Author

XVilka commented Jul 29, 2020

@CreepySkeleton sadly no time for this, I am already scattered among many projects.

@louib
Copy link

louib commented Jun 14, 2021

@XVilka did you get any updates on this issue? I see that your 2 PRs ended up being merged.

@olalonde
Copy link

Is this project still maintained? @chyh1990 @XVilka or is there a maintained fork?

@XVilka
Copy link
Contributor Author

XVilka commented Aug 1, 2022

@olalonde not that I am aware of. Maybe @dtolnay could suggest an alternative.

@dtolnay
Copy link
Collaborator

dtolnay commented Aug 1, 2022

I am not aware of a maintained fork.

@davvid
Copy link

davvid commented Mar 20, 2024

My (previously) maintained fork (yaml-rust-davvid` @ crates.io) has merged efforts with @Ethiraric's fork as of Ethiraric#2.

yaml-rust users should switch over to the actively maintained yaml-rust2 project ~ https://github.com/Ethiraric/yaml-rust2 (yaml-rust2 @ crates.io).

Upgrading from yaml-rust

Use this Cargo.toml snippet to use yaml-rust2 as a drop-in replacement for yaml-rust:

[dependencies]
yaml-rust = { version = "0.6", package = "yaml-rust2" }

This allows you to switch to yaml-rust2 while continuing to refer to yaml_rust in your code (e.g. use yaml_rust::YamlLoader; will continue to work so that no Rust code changes are required).

nazmulidris added a commit to r3bl-org/r3bl-open-core that referenced this issue Apr 15, 2024
`yaml-rust` crate is unmaintained

1) `syntect` author won't update this dep to a fork of it due to lack
of trust concerns with this new fork:
trishume/syntect#526

2) cargo-deny produces this output:

error[unmaintained]: yaml-rust is unmaintained.
    ┌─ /home/nazmul/github/r3bl-open-core/Cargo.lock:295:1
    │
295 │ yaml-rust 0.4.5 registry+https://github.com/rust-lang/crates.io-index
    │ --------------------------------------------------------------------- unmaintained advisory detected
    │
    = ID: RUSTSEC-2024-0320
    = Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0320
    = The maintainer seems [unreachable](chyh1990/yaml-rust#197).

      Many issues and pull requests have been submitted over the years
      without any [response](chyh1990/yaml-rust#160).

      ## Alternatives

      Consider switching to the actively maintained `yaml-rust2` fork of the original project:

      - [yaml-rust2](https://github.com/Ethiraric/yaml-rust2)
      - [yaml-rust2 @ crates.io](https://crates.io/crates/yaml-rust2))
    = Announcement: rustsec/advisory-db#1921
    = Solution: No safe upgrade is available!
    = yaml-rust v0.4.5
      └── syntect v5.1.0
          └── r3bl_tui v0.5.2
              └── r3bl-cmdr v0.0.11
nazmulidris added a commit to r3bl-org/r3bl-open-core that referenced this issue Apr 15, 2024
`yaml-rust` crate is unmaintained

1) `syntect` author won't update this dep to a fork of it due to lack
of trust concerns with this new fork:
trishume/syntect#526

2) cargo-deny produces this output:

error[unmaintained]: yaml-rust is unmaintained.
    ┌─ /home/nazmul/github/r3bl-open-core/Cargo.lock:295:1
    │
295 │ yaml-rust 0.4.5 registry+https://github.com/rust-lang/crates.io-index
    │ --------------------------------------------------------------------- unmaintained advisory detected
    │
    = ID: RUSTSEC-2024-0320
    = Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0320
    = The maintainer seems [unreachable](chyh1990/yaml-rust#197).

      Many issues and pull requests have been submitted over the years
      without any [response](chyh1990/yaml-rust#160).

      ## Alternatives

      Consider switching to the actively maintained `yaml-rust2` fork of the original project:

      - [yaml-rust2](https://github.com/Ethiraric/yaml-rust2)
      - [yaml-rust2 @ crates.io](https://crates.io/crates/yaml-rust2))
    = Announcement: rustsec/advisory-db#1921
    = Solution: No safe upgrade is available!
    = yaml-rust v0.4.5
      └── syntect v5.1.0
          └── r3bl_tui v0.5.2
              └── r3bl-cmdr v0.0.11
@tahaafzal5
Copy link

tahaafzal5 commented May 18, 2024

My (previously) maintained fork (yaml-rust-davvid` @ crates.io) has merged efforts with @Ethiraric's fork as of Ethiraric#2.

yaml-rust users should switch over to the actively maintained yaml-rust2 project ~ https://github.com/Ethiraric/yaml-rust2 (yaml-rust2 @ crates.io).

Upgrading from yaml-rust

Use this Cargo.toml snippet to use yaml-rust2 as a drop-in replacement for yaml-rust:

[dependencies]
yaml-rust = { version = "0.6", package = "yaml-rust2" }

This allows you to switch to yaml-rust2 while continuing to refer to yaml_rust in your code (e.g. use yaml_rust::YamlLoader; will continue to work so that no Rust code changes are required).

I have a direct dependency on config v0.13 in my project, so I have a transient dependency on yaml-rust v0.4.5.
I am using cargo deny check advisories to check for any advisories (including unmaintained advisories) in my CI. Since yaml-rust is unmaintained, that step in the CI fails.

I want to replace the transient dependency on yaml-rust with yaml-rust2 v0.7.0

I have tried the following 3 things but they all fail to replace yaml-rust.
1.

yaml-rust = { version = "0.6", package = "yaml-rust2" }
[patch.'https://github.com/chyh1990/yaml-rust']
yaml-rust2 = { git = 'https://github.com/Ethiraric/yaml-rust2.git' }
[patch.crates-io]
yaml-rust = { git = 'https://github.com/Ethiraric/yaml-rust2.git' }

Am I doing something wrong?
My Cargo.toml is here.

tkmcmaster added a commit to FamilySearch/pewpew that referenced this issue Jun 3, 2024
* Moved deprecated .cargo/config to config.toml

* Ignore clippy warning

* Updated body_reader and channel dependencies

* Updated config-wasm and hdr-histogram dependencies

* Updated additional dependencies

- Held back hyper, http, and yansi due to major changes

* Updated Yansi to latest version

- Converted Paint::disable to Yansi::disable
- Removed Windows specific code. Yansi now will try to enable on Windows and automatically disables if it can't activate.

* Added build test-server to the PR script and workflow

* Fix dependency loop with ahash on itself

- tkaitchuck/aHash#95 (comment)
- rustwasm/wasm-bindgen#3031 (comment)

* Updated yaml-rust to use yaml-rust2 due to deprecation

- chyh1990/yaml-rust#197
- chyh1990/yaml-rust#160 (comment)

* Updated cargo deny to remove deprecated entries

- EmbarkStudios/cargo-deny#611
- https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-clarify-field-optional

* Updated cargo lock file

* Updated code for deprecations

- Added tests for create_date_diff, then updated deprecated calls and confirmed tests still passed

* Added clippy ignore large results and errors

* Fixed tests to validate to UTC

- Since the PR flow runs on UTC, updated the local PR script to also run UTC
- Updated the create_date_diff test to validate UTC and print a warning to run UTC if it fails
tkmcmaster added a commit to FamilySearch/pewpew that referenced this issue Jun 3, 2024
* Moved deprecated .cargo/config to config.toml

* Ignore clippy warning

* Updated body_reader and channel dependencies

* Updated config-wasm and hdr-histogram dependencies

* Updated additional dependencies

- Held back hyper, http, and yansi due to major changes

* Updated Yansi to latest version

- Converted Paint::disable to Yansi::disable
- Removed Windows specific code. Yansi now will try to enable on Windows and automatically disables if it can't activate.

* Added build test-server to the PR script and workflow

* Fix dependency loop with ahash on itself

- tkaitchuck/aHash#95 (comment)
- rustwasm/wasm-bindgen#3031 (comment)

* Updated yaml-rust to use yaml-rust2 due to deprecation

- chyh1990/yaml-rust#197
- chyh1990/yaml-rust#160 (comment)

* Updated cargo deny to remove deprecated entries

- EmbarkStudios/cargo-deny#611
- https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html#the-clarify-field-optional

* Updated cargo lock file

* Updated code for deprecations

- Added tests for create_date_diff, then updated deprecated calls and confirmed tests still passed

* Added clippy ignore large results and errors

* Fixed tests to validate to UTC

- Since the PR flow runs on UTC, updated the local PR script to also run UTC
- Updated the create_date_diff test to validate UTC and print a warning to run UTC if it fails
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

8 participants