RUSTSEC-2020-0095: difference is unmaintained

[jonasbb]

difference is a dependency of pretty-assertions. The crate is unmaintained now, see the RUSTSEC-2020-0095 advisory.
pretty-assertions is used quite a bit in the ecosystem and since it pulls in difference cargo audit will warn about this in every crate.
Maybe it is possible to migrate to one of the alternatives listed in the advisory.

[brightly-salty]

I'd be willing to attempt this and submit a PR if it would be accepted.

[brightly-salty]

Actually looks like difference provides a pretty large portion of pretty_assertion's functionality. It looks like diffus will provide the best replacement, but I think this is not the job for a first-time contributor.

[mitsuhiko]

If someone wants to give this a try, the inline highlighting of this crate is something I would also like to the similar replacement crate. Then that would become a pretty straightforward drop in replacement.

This example is probably close enough to what pretty-assertions uses difference for: https://github.com/mitsuhiko/similar/blob/main/examples/terminal-inline.rs

[tommilligan]

I've submitted an implementation in #45 using diffus to replace difference - open to any feedback on the details

[mitsuhiko]

@tommilligan curious why you're saying similar does not support line diffing.

[tommilligan]

@mitsuhiko apologies, going back and reading the docs I see it clearly supports arbitrary sequences 🤦‍♂️ my bad.

In that case I will port my PR to similar as well, then compare the build size/performance of both against master. Ideally I would like a zero-dependency crate, so similar wins over diffus there.

[mitsuhiko]

@tommilligan fwiw with similar the entire crate gets reduced to something like this: https://gist.github.com/mitsuhiko/b2e1b280bebedc783495a10b0fa7b3e2

Note that currently similar's inline feature pulls in the unicode crate which is also why I made that feature optional, but I think it would also probably make sense to make the inline diffing more configurable so that the unicode feature is not needed.

Looks like this:

[mrcosta]

Did you get any feedback from the maintainer? The last update in this crate is quite old. @colin-kiegel are you around? Otherwise is one more crate to maybe open a rust-sec entry =/

[tommilligan]

@mrcosta I've made contact with @colin-kiegel and we've outlined a plan for ongoing maintenance of the pretty_assertions crate. I'll be working on implementing it over the next few weeks. No rust-sec entry required yet!

I'm happy to ping you when I have a more formal plan and tasklist written up for comment.

[tommilligan]

A fix has been merged to main - the next release will not depend on difference.