Add unmaintained advisory for syslog crate #1672
Conversation
| # The syslog crate is no longer maintained by it's current owner. | ||
| # | ||
| # The PR referenced above has had no response for a year a three months. | ||
| # I tried to contact the owner through Github and the email associated with their Github account. |
There was a problem hiding this comment.
Please can we use formatting / fill the necessary detail accordingly per this example:
https://github.com/rustsec/advisory-db/blob/main/crates/buf_redux/RUSTSEC-2023-0028.md
Other than that don't see why this advisory should get merged as of now - it should also be actionable.
Our unmaintained advisories are reserved for completely unreachable maintainers and I don't see the necessary explicit communication that would support / merit flagging an advisory.
The maintainer seems very active and I don't see that maintainer would not merge security fixes if any.
@Geal just wondering if it would be worthwhile to nudge people to use other implementations ? Personally I don't see big reason to flag warning but just in case you would feel a gentle note would be warranted from your maintainer PoV that this crate may be deprecated possibly and you would be happy for people to not use the crate ?
Re; alternatives there seems another syslog implementation by name of syslog-rs but I'm not going to paint any alternatives at this stage since the maintainer hasn't had the word out.
There was a problem hiding this comment.
well that was a rude way to get my attention 😁
That crate is not unmaintained, it's just that as a very thin wrapper over syslog, it does not warrant a lot of releases (it's mostly 1 per year by now), unless there are serious issues or vulnerabilities, and that PR was neither.
@bheylin I'll get to it, chill a bit.
There was a problem hiding this comment.
@pinkforest I thought that a year plus response time on a PR would warrant a crate as unmaintained.
But fair enough, you use a stricter definition of unmaintained.
@Geal apologies for my rudeness. I understand that syslog doesn't warrant a lot of releases.
But it's a shame that I can't use the crate on FreeBSD.
Thanks for your time all
pinkforest
added
Unmaintained
pinkforest
removed
Unmaintained
The syslog crate is no longer maintained by it's current owner.
The PR referenced in the advisory has had no response for a year a three months.
I tried to contact the owner through Github and the email associated with their Github account.