`paste` dependency no longer maintained

[tomtom5152]

RUSTSET has just published RUSTSEC-2024-0436 detailing how paste is no longer maintained and has been archived. This is used by both the latest 0.7.7 release and the 0.8 branch.

[gbj]

This is quite a frustrating RUSTSEC advisory, which is going to have much larger repercussions.

Given that itertools, wasm-bindgen, sqlx, pyo3-ffi, and many other huge crates use this as a dependency, my assumption would be that someone else is going to end up taking over maintenance.

There are no listed alternatives and dtolnay (creator of paste) commented on the RUSTSEC issue asking them to remove the alternatives that had initially been listed, which are almost certainly all less reliable.

Anyway, just wanted to post a note to say I'd seen this, and that my plan is to wait and see where the ecosystem lands.

[martinfrances107]

I agree with the wait and see approach

So this is a minor point.. just to add a voice to the discussion.

This is quite a frustrating RUSTSEC advisory, which is going to have much larger repercussions

I think I reason differently with the "frustrating" aspect.. it is reasonable for a contingent of the community to say "I want nothing to do with unmaintained code". Yep this consequential, is going to trigger activity in many popular crates.

It really tough to find a position that serves all contingents.

Please excuse my sense of humour, but to end on a happy note, at least we are not the much more diverse linux-rust community where a recently push back from different voices was hey we can't accept this rust patch -- we will wait it is not secure beacuse rust does not yet have a formal specification...

[gbj]

To clarify, here's why I find it frustrating:

1. There's no meaningful action we can take: removing paste from our dependencies would not remove it from any user's dependency tree, it would simply add another dependency, increasing both compile times and the security threat surface.
2. Because proc-macro crates can run arbitrary code during compile time (even during rust-analyzer bootup/check time!) they do present a real security risk. The advice to migrate away from a crate owned by a major pillar of the Rust language ecosystem, which has been archived because it is complete, to a fork by someone nobody knows and who there's no reason to trust, seems unwise to me.

[johan-smits]

Is it still the case to stay on the unmaintained version?

[gbj]

@johan-smits Nothing has changed with regard to anything discussed in this thread. paste is still widely used in the Rust ecosystem, including (importantly) by itertools and wasm-bindgen, so removing paste from leptos itself would not remove it from anyone's dependency chain — it would simply increase the potential attack surface by adding yet another dependency. paste has 30x the daily downloads of pastey and is owned by a reputable Rust library developer who maintains multiple crates that are at the heart of the ecosystem.