prettyplease VS advisory-db

Nice blog, another very useful crate to use when working with proc-macro is https://github.com/dtolnay/prettyplease, for formatting generated code (very useful for debugging!), that does not bails out like rustfmt sometimes does.

I doubt you would want to actually use this human-consumed code, but an interesting alternative that I know of is David Tolnay's prettyplease. It tries to be lightweight and consistent for auto-generated code.

btw there is also https://github.com/dtolnay/prettyplease

This, I also have a bunch of files that seem to break rustfmt. Ime, it doesn't exactly refuse to format the whole file but it's picky in what and to what degree it chooses to format, basically anything flying in the complex blocks. I have run into prettyplease but I'm yet to actually try it on these offenders.

prettyplease

Optionally, format the generated code to make it more readable. You can run rustfmt on the output file, or use prettyplease before writing the file.

You might also want to add this to https://github.com/rustsec/advisory-db so that cargo audit and Dependabot surface it.

The behavior of not extracting outside the specified directory has been the default since forever in Rust's tar. And then it had two RUSTSEC advisories for not handling this correctly in certain corner cases. The latest one in 2021.

cargo-audit only checks for known issues reported to a vulnerability database.

However, I keep getting this error when running cargo audit bin ~/.cargo/bin/*, even if I replace * with a specific binary: Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 467 security advisories (from C:\Users\jonah\.cargo\advisory-db) Updating crates.io index error: I/O operation failed: The system cannot find the path specified. (os error 3) I'm on Windows 10.

I usually open an issue asking if the crate is still maintained. If there isn't a response for a decent amount of time (like multiple months) and the crate is somewhat popular then it could be worth opening an unmaintained advisory in the advisory-db

Here is the visualization of RustSec Advisory Database. I hope it will be helpful. If you need any more charts, feel free to comment.

FWIW the RustSec database is still not synced into the Github databse on a regular basis, even though they did an initial import of it. So the cargo audit github action is still relevant.