RUSTSEC-2024-0370: proc-macro-error is unmaintained
- Dominant language
- Rust
- Stars
- 282
- Forks
- 150
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 2
Description
> proc-macro-error is unmaintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `proc-macro-error` |
| Version | `1.0.4` |
| URL | [https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20](https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20) |
| Date | 2024-09-01 |
proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.
proc-macro-error also depends on `syn 1.x`, which may be bringing duplicate dependencies into dependant build trees.
## Possible Alternative(s)
- [manyhow](https://crates.io/crates/manyhow)
- [proc-macro-error2](https://crates.io/crates/proc-macro-error2)
- [proc-macro2-diagnostics](https://github.com/SergioBenitez/proc-macro2-diagnostics)
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2024-0370.html) for additional details.
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names the proc-macro-error 1.0.4 package and lists manyhow, proc-macro-error2, and proc-macro2-diagnostics as alternatives, but no repository file, test, or entry point. Start by locating the package in the dependency manifests and checking which alternative is compatible. Done means the unmaintained dependency is removed without breaking the build or its tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100