RUSTSEC-2020-0036: failure is officially deprecated/unmaintained

[extrawurst]

cargo audit spits out:

warning: 1 warning found

Crate:  failure
Title:  failure is officially deprecated/unmaintained
Date:   2020-05-02
URL:    https://rustsec.org/advisories/RUSTSEC-2020-0036

Rooted in symbolic-common using failure.
Did not check the code yet, but how deep is it entangled?

this bubbled up in my gitui project: gitui-org/gitui#248

[jan-auer]

Thanks! We are looking to remove failure in favor of std::error::Error soon.

In the past, the only blocker for us has been missing stabilization of Error::backtrace, which we rely on heavily in our production services. However, we've recently come to the conclusion that libraries like symbolic should not capture backtraces on their own, so I believe that we can now start to replace failure.

[extrawurst]

Any update on this?

[Swatinem]

I’m starting to work on this, first in symbolicator, which has no semver requirements and can therefore internally break whatever it wants. After gaining some experience in this, we will try to tackle symbolic. The challenge here is to do it without breaking the API, for example by doing it behind a feature flag.

[Swatinem]

failure was removed some time ago, and we don’t even have it in transitive dependencies anymore.