-
Notifications
You must be signed in to change notification settings - Fork 215
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove paste
dependency.
#1064
Comments
Does the crate really need maintain? It's really easy, outputs deterministic results, and has no runtime dependencies. |
Hi, I fully agree with your statements here. However, the ASF has been seen as open-source software stewards (according to the CRA), so it is our own responsibility to ensure our dependencies are up to date and well-maintained. Otherwise, at some point (though no one has yet), someone may raise a CVE against us, forcing us to take urgent action. We can still defend our position as we've discussed here, but most end users—who may not even know what Rust is—only find us because our project appears in their SBOM. They will simply see that Ultimately, we need to take action. We should either remove |
There are three approaches
Which one do we prefer ? |
will this be heavy work? |
Both 2 and 3 LGTM. The usage of |
|
It would be great if we expand them directly. |
Is your feature request related to a problem or challenge?
As describen in #1053 ,
paste
crate is no longer maintained.Describe the solution you'd like
We need to refactor our code to remove depencendy of
paste
crate.Willingness to contribute
The text was updated successfully, but these errors were encountered: