Skip to content

feat(deps): replace simple-tqdm with indicatif 0.18 to avoid unmaintained number_prefix#954

Merged
fgimenez merged 2 commits intomainfrom
fgimenez/fix-cargo-deny
Nov 18, 2025
Merged

feat(deps): replace simple-tqdm with indicatif 0.18 to avoid unmaintained number_prefix#954
fgimenez merged 2 commits intomainfrom
fgimenez/fix-cargo-deny

Conversation

@fgimenez
Copy link
Copy Markdown
Member

@fgimenez fgimenez commented Nov 18, 2025

fixes errors like this one in https://github.com/tempoxyz/tempo/actions/runs/19462129274/job/55688586205?pr=948:

cargo deny --all-features check all
  shell: /usr/bin/bash -e {0}
  env:
    CARGO_TERM_COLOR: always
    CARGO_HOME: /home/runner/.cargo
    CARGO_INCREMENTAL: 0
error[unmaintained]: number_prefix crate is unmaintained
    ┌─ /home/runner/work/tempo/tempo/Cargo.lock:487:1
    │
487 │ number_prefix 0.4.0 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
    │
    ├ ID: RUSTSEC-2025-0119
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0119
    ├ The `number_prefix` crate is no longer actively maintained.  If you rely on this crate, consider switching to a recommended alternative.
      
      ## Recommended alternatives
      
      - [`unit-prefix`](https://crates.io/crates/unit-prefix)
    ├ Announcement: https://github.com/ogham/rust-number-prefix/pull/8
    ├ Solution: No safe upgrade is available!
    ├ number_prefix v0.4.0
      └── indicatif v0.17.11
          └── simple-tqdm v0.2.0
              ├── tempo-bench v0.4.0
              └── tempo-xtask v0.4.0

@fgimenez fgimenez added the A-ci Related to github workflows or other build and lint tools label Nov 18, 2025
@fgimenez fgimenez enabled auto-merge (squash) November 18, 2025 11:06
SuperFluffy
SuperFluffy requested changes Nov 18, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@SuperFluffy SuperFluffy left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bump indicatif instead. They have migrated to unit-prefix: https://github.com/console-rs/indicatif/blob/2f2b2ccbd3695e0a3cdbfed42c0d60190f732bbc/Cargo.toml#L18

@fgimenez
Copy link
Copy Markdown
Member Author

fgimenez commented Nov 18, 2025

Bump indicatif instead. They have migrated to unit-prefix: https://github.com/console-rs/indicatif/blob/2f2b2ccbd3695e0a3cdbfed42c0d60190f732bbc/Cargo.toml#L18

@SuperFluffy yeah, the problem is that simple-tqdm is locked to [email protected] and this one pulls the unmaintained crate, no new version of simple-tqdm atm. we could try to update the code to use indicatif directly instead of simple-tqdm, can do that in a followup, wdyt?

@SuperFluffy
Copy link
Copy Markdown
Contributor

SuperFluffy commented Nov 18, 2025

Bump indicatif instead. They have migrated to unit-prefix: https://github.com/console-rs/indicatif/blob/2f2b2ccbd3695e0a3cdbfed42c0d60190f732bbc/Cargo.toml#L18

@SuperFluffy yeah, the problem is that simple-tqdm is locked to [email protected] and this one pulls the unmaintained crate, no new version of simple-tqdm atm. we could try to update the code to use indicatif directly instead of simple-tqdm, can do that in a followup, wdyt?

We should absolutely migrate. Looking at simple-tqdm, it was never maintained in the first place.

IMO we should either do it now or close this PR. We shouldn't even start silencing nags like this one if there is a clear fix (lest we forget to actually followup).

@fgimenez fgimenez force-pushed the fgimenez/fix-cargo-deny branch from 8231f7f to 556f9d4 Compare November 18, 2025 12:26
@fgimenez fgimenez changed the title fix(deny): ignore RUSTSEC-2025-0119 for unmaintained number_prefix feat(deps): replace simple-tqdm with indicatif 0.18 to avoid unmaintained number_prefix Nov 18, 2025
@fgimenez
Copy link
Copy Markdown
Member Author

fgimenez commented Nov 18, 2025

We should absolutely migrate. Looking at simple-tqdm, it was never maintained in the first place.

makes sense, done in this PR ptal

klkvr
klkvr approved these changes Nov 18, 2025
View reviewed changes
SuperFluffy
SuperFluffy approved these changes Nov 18, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@SuperFluffy SuperFluffy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good - we got cloudflare issues?

@fgimenez fgimenez force-pushed the fgimenez/fix-cargo-deny branch from 9f697b7 to 7dd763c Compare November 18, 2025 13:33
@fgimenez fgimenez force-pushed the fgimenez/fix-cargo-deny branch from 59120b5 to a969d8d Compare November 18, 2025 13:57
@SuperFluffy SuperFluffy mentioned this pull request Nov 18, 2025
Merged
@fgimenez fgimenez merged commit bd63914 into main Nov 18, 2025
29 of 37 checks passed
@fgimenez fgimenez deleted the fgimenez/fix-cargo-deny branch November 18, 2025 14:50
@SuperFluffy
Copy link
Copy Markdown
Contributor

SuperFluffy commented Nov 18, 2025

This has one confusing commit message now. :-D

@fgimenez
Copy link
Copy Markdown
Member Author

fgimenez commented Nov 18, 2025

This has one confusing commit message now. :-D

hmm this is weird i changed the PR title and amended the commit message...

@SuperFluffy
Copy link
Copy Markdown
Contributor

SuperFluffy commented Nov 18, 2025

This has one confusing commit message now. :-D

hmm this is weird i changed the PR title and amended the commit message...

It's because you added the PR to the merge queue before your changes. The only "sync point" between PR title/body and commit title/body is when you enable auto-merge - that's the moment it takes the PR title/body and suggests it for your commit.

It happened to me as well before. :-)

fgimenez added a commit that referenced this pull request Nov 18, 2025
@fgimenez
feat(deps): replace simple-tqdm with indicatif 0.18 to avoid unmainta…
bf313ed 
…ined number_prefix (#954)
@fgimenez
Copy link
Copy Markdown
Member Author

fgimenez commented Nov 18, 2025

It's because you added the PR to the merge queue before your changes. The only "sync point" between PR title/body and commit title/body is when you enable auto-merge - that's the moment it takes the PR title/body and suggests it for your commit.

TIL, very good to know thx!

unbalancedparentheses pushed a commit to unbalancedparentheses/tempo that referenced this pull request Feb 23, 2026
@fgimenez
fix(deny): ignore RUSTSEC-2025-0119 for unmaintained number_prefix (t…
9ec5527 
…empoxyz#954)

fixes errors like this one in
https://github.com/tempoxyz/tempo/actions/runs/19462129274/job/55688586205?pr=948:
```
cargo deny --all-features check all
  shell: /usr/bin/bash -e {0}
  env:
    CARGO_TERM_COLOR: always
    CARGO_HOME: /home/runner/.cargo
    CARGO_INCREMENTAL: 0
error[unmaintained]: number_prefix crate is unmaintained
    ┌─ /home/runner/work/tempo/tempo/Cargo.lock:487:1
    │
487 │ number_prefix 0.4.0 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
    │
    ├ ID: RUSTSEC-2025-0119
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0119
    ├ The `number_prefix` crate is no longer actively maintained.  If you rely on this crate, consider switching to a recommended alternative.
      
      ## Recommended alternatives
      
      - [`unit-prefix`](https://crates.io/crates/unit-prefix)
    ├ Announcement: ogham/rust-number-prefix#8
    ├ Solution: No safe upgrade is available!
    ├ number_prefix v0.4.0
      └── indicatif v0.17.11
          └── simple-tqdm v0.2.0
              ├── tempo-bench v0.4.0
              └── tempo-xtask v0.4.0
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SuperFluffy SuperFluffy SuperFluffy approved these changes

@klkvr klkvr klkvr approved these changes

@0xKitsune 0xKitsune 0xKitsune approved these changes

@Zygimantass Zygimantass Awaiting requested review from Zygimantass Zygimantass is a code owner

Assignees

No one assigned

Labels

A-ci Related to github workflows or other build and lint tools

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@fgimenez @SuperFluffy @klkvr @0xKitsune