Pre-RFC: Reviving "Security advisories in crates.io" (RFC PR #1752)

No worries about scope creep! I think a bulk cargo yank feature, combined with a structured "yank with reason" feature (see e.g. rust-lang/cargo#2608), could potentially meet the use cases of both security advisories and these sorts of "showstopper bug" use cases. I think there might be merit in pursuing this sort of approach as a generally useful feature and a building block for security advisories.

Indeed these sorts of error messages in the cargo build workflow:

*** warning: security vulnerabilities found in 2 dependencies! Run `cargo audit` for details.

Could alternatively look like this:

*** warning: 2 insecure and 3 yanked dependencies in Cargo.lock! Run `cargo audit` for details.

Indeed... I think a lot of showstopper bugs of this nature might ultimately be advisory-worthy

3 Likes