Skip to content

Conversation

@fgimenez
Copy link
Member

fixes errors like this one in https://github.com/tempoxyz/tempo/actions/runs/19462129274/job/55688586205?pr=948:

cargo deny --all-features check all
  shell: /usr/bin/bash -e {0}
  env:
    CARGO_TERM_COLOR: always
    CARGO_HOME: /home/runner/.cargo
    CARGO_INCREMENTAL: 0
error[unmaintained]: number_prefix crate is unmaintained
    ┌─ /home/runner/work/tempo/tempo/Cargo.lock:487:1
    │
487 │ number_prefix 0.4.0 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
    │
    ├ ID: RUSTSEC-2025-0119
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0119
    ├ The `number_prefix` crate is no longer actively maintained.  If you rely on this crate, consider switching to a recommended alternative.
      
      ## Recommended alternatives
      
      - [`unit-prefix`](https://crates.io/crates/unit-prefix)
    ├ Announcement: https://github.com/ogham/rust-number-prefix/pull/8
    ├ Solution: No safe upgrade is available!
    ├ number_prefix v0.4.0
      └── indicatif v0.17.11
          └── simple-tqdm v0.2.0
              ├── tempo-bench v0.4.0
              └── tempo-xtask v0.4.0

@fgimenez fgimenez added the A-ci Related to github workflows or other build and lint tools label Nov 18, 2025
@fgimenez fgimenez enabled auto-merge (squash) November 18, 2025 11:06
Copy link
Collaborator

@SuperFluffy SuperFluffy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fgimenez
Copy link
Member Author

Bump indicatif instead. They have migrated to unit-prefix: https://github.com/console-rs/indicatif/blob/2f2b2ccbd3695e0a3cdbfed42c0d60190f732bbc/Cargo.toml#L18

@SuperFluffy yeah, the problem is that simple-tqdm is locked to indicatif@0.17.7 and this one pulls the unmaintained crate, no new version of simple-tqdm atm. we could try to update the code to use indicatif directly instead of simple-tqdm, can do that in a followup, wdyt?

@SuperFluffy
Copy link
Collaborator

Bump indicatif instead. They have migrated to unit-prefix: https://github.com/console-rs/indicatif/blob/2f2b2ccbd3695e0a3cdbfed42c0d60190f732bbc/Cargo.toml#L18

@SuperFluffy yeah, the problem is that simple-tqdm is locked to indicatif@0.17.7 and this one pulls the unmaintained crate, no new version of simple-tqdm atm. we could try to update the code to use indicatif directly instead of simple-tqdm, can do that in a followup, wdyt?

We should absolutely migrate. Looking at simple-tqdm, it was never maintained in the first place.

IMO we should either do it now or close this PR. We shouldn't even start silencing nags like this one if there is a clear fix (lest we forget to actually followup).

@fgimenez fgimenez force-pushed the fgimenez/fix-cargo-deny branch from 8231f7f to 556f9d4 Compare November 18, 2025 12:26
@fgimenez fgimenez changed the title fix(deny): ignore RUSTSEC-2025-0119 for unmaintained number_prefix feat(deps): replace simple-tqdm with indicatif 0.18 to avoid unmaintained number_prefix Nov 18, 2025
@fgimenez
Copy link
Member Author

We should absolutely migrate. Looking at simple-tqdm, it was never maintained in the first place.

makes sense, done in this PR ptal

Copy link
Collaborator

@SuperFluffy SuperFluffy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good - we got cloudflare issues?

@fgimenez fgimenez force-pushed the fgimenez/fix-cargo-deny branch from 9f697b7 to 7dd763c Compare November 18, 2025 13:33
fgimenez and others added 2 commits November 18, 2025 13:57
Co-authored-by: Arsenii Kulikov <klkvrr@gmail.com>
@fgimenez fgimenez force-pushed the fgimenez/fix-cargo-deny branch from 59120b5 to a969d8d Compare November 18, 2025 13:57
@fgimenez fgimenez merged commit bd63914 into main Nov 18, 2025
29 of 37 checks passed
@fgimenez fgimenez deleted the fgimenez/fix-cargo-deny branch November 18, 2025 14:50
@SuperFluffy
Copy link
Collaborator

This has one confusing commit message now. :-D

@fgimenez
Copy link
Member Author

This has one confusing commit message now. :-D

hmm this is weird i changed the PR title and amended the commit message...

@SuperFluffy
Copy link
Collaborator

This has one confusing commit message now. :-D

hmm this is weird i changed the PR title and amended the commit message...

It's because you added the PR to the merge queue before your changes. The only "sync point" between PR title/body and commit title/body is when you enable auto-merge - that's the moment it takes the PR title/body and suggests it for your commit.

It happened to me as well before. :-)

fgimenez added a commit that referenced this pull request Nov 18, 2025
@fgimenez
Copy link
Member Author

It's because you added the PR to the merge queue before your changes. The only "sync point" between PR title/body and commit title/body is when you enable auto-merge - that's the moment it takes the PR title/body and suggests it for your commit.

TIL, very good to know thx!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-ci Related to github workflows or other build and lint tools

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants