Report json as unmaintained #1536
Merged
+28
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ecton
force-pushed
the
json-unmaintained
branch
from
d9a499b to
b896e66
Compare
|
Hey ecton thanks a lot for the contribution :) I gotta just align the date to when it's reported as we align to to other security database standard on that + refer to the soudness issue 🥳 btw I found there was also: https://crates.io/crates/simd-json |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A thread on Reddit yesterday led me to investigate a few different JSON crates in the ecosystem. One of the most popular ones beyond serde-json that reported fast benchmarks is
json. I investigated it and discovered users have asked if the project is abandoned without reponse. Given how popular this crate appears to be given the recent downloads, I felt an unmaintained advisory was warranted.Scanning the issues list, I also found this issue that may introduce undefined behavior. This triggers a Miri error under the stacked borrows model, but I'm not sure if that's enough to warrant a mention in the advisory or not.