Unmaintained dependency atty causes security warning

[fwilhe2]

Hi,

I've noticed github shows me this warning for my project that uses cargo-mutants: GHSA-g98v-hv3f-hcfr

It has low severity, so it is probably not too bad, but an unmaintained dependency does not sound great. I'm not an expert in rust or the rust ecosystem, but the github message makes it sound like a relatively good alternative is available with https://crates.io/crates/is-terminal, also in the standard library starting in a specific version of rust.

I searched the issues and I could not find anyone reporting this previously, thus opening this new issue.

[sourcefrog]

I don't believe there is an actual security issue in cargo-mutants: That report says

* In practice however, the pointer won't be unaligned unless a custom global allocator is used.

We don't use a custom global allocator in cargo-mutants. I also can't imagine how this would be exploitable in the context of cargo-mutants, or a project using cargo-mutants. Martin

[fwilhe2]

Hey Martin, thanks for triaging. Do you see an issue with this unmaintained dependency (even if very low prio)?

Feel free to close this issue if you deem appropriate.

[sourcefrog]

On the one hand it's nice to avoid the alerts even if they're false positives. On the other hand relying on not-actively-maintained code with no known active bugs or issues is a very low-priority problem, and probably unavoidable in general. I'll leave it open for the moment but as a low priority.

…

Message ID: ***@***.***>