You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello, I wanted to raise a note that this crate currently has a transitive dependency on option-ext. That library is MPL-2, a copyleft license. The option-ext dependency is brought in via the dependency on directories. The maintainer of the underlying dirs-sys crate has indicated that they added a dependency on option-ext for the express purpose of tainting the use of dirs-sys with MPL-2, which thus taints any use of update-informer. I'd recommend using an alternate dependency such as etcetera, which does not suffer from this tainting issue.
I'll note that the default ureq dependency also pulls in webpki-roots, which is also MPL-2, but that is an optional dependency that can be side-stepped by using native-tls (though I would overall prefer to use rustls-tls, but with native-roots), so it's not a particular concern for me.
As an alternative, the caching functionality could be optional behind a feature, so that the MPL-2 dependency isn't required if we don't need the caching check.
The text was updated successfully, but these errors were encountered:
Hello, I wanted to raise a note that this crate currently has a transitive dependency on
option-ext
. That library is MPL-2, a copyleft license. Theoption-ext
dependency is brought in via the dependency ondirectories
. The maintainer of the underlyingdirs-sys
crate has indicated that they added a dependency onoption-ext
for the express purpose of tainting the use ofdirs-sys
with MPL-2, which thus taints any use ofupdate-informer
. I'd recommend using an alternate dependency such asetcetera
, which does not suffer from this tainting issue.I'll note that the default
ureq
dependency also pulls inwebpki-roots
, which is also MPL-2, but that is an optional dependency that can be side-stepped by usingnative-tls
(though I would overall prefer to userustls-tls
, but withnative-roots
), so it's not a particular concern for me.As an alternative, the caching functionality could be optional behind a feature, so that the MPL-2 dependency isn't required if we don't need the caching check.
The text was updated successfully, but these errors were encountered: