Replace unmaintained `ansi_term` dependency `(RUSTSEC-2021-0139)` with a maintained alternative.
Hey all,
`just` currently depends on `ansi_term = "0.12.0"` (see `Cargo.toml`). The crate has been marked unmaintained by its author since 2021 and has an active RustSec advisory:
- Advisory: [RUSTSEC-2021-0139](https://rustsec.org/advisories/RUSTSEC-2021-0139.html)
- Upstream notice: [ogham/rust-ansi-term#72](https://github.com/ogham/rust-ansi-term/issues/72)
- Last release: 0.12.1 in 2020
This isn't a vulnerability, it's an `INFO`/`unmaintained` advisory but it shows up in `cargo audit` runs for anyone packaging or consuming `just`, and the crate won't receive bug fixes or compatibility updates going forward.
It's used in `ansi_term` and is referenced in just a few places in `src/`:
- `src/color.rs` — imports `ANSIGenericString`, `Color`, `Prefix`, `Style`, `Suffix`
- `src/command_color.rs` — `impl From<CommandColor> for ansi_term::Color`
- `src/config.rs` — `command_color: Option<ansi_term::Color>`
- `src/run.rs` — `ansi_term::enable_ansi_support()`
The surface area looks small (~200 lines across two files do almost all of the work), so a migration should be reasonably contained.
Some alternatives I suggest come from the RustSec advisory, which lists several maintained replacements. The most natural candidates for `just` are:
- **`anstyle`**, minimal, no_std-friendly, and already a transitive dep via `clap`, so it would *reduce* the dependency graph rather than swap one crate for another. Best fit if the goal is leanness.
- **`nu-ansi-term`**, a near drop-in fork of `ansi_term` maintained by the Nushell team. Lowest-effort migration if API compatibility is the priority.
- **`owo-colors`**, ergonomic extension-trait API, also widely used.
Given that `clap` (already a dependency) pulls in `anstyle` transitively, that seems like the cleanest path, but `nu-ansi-term` is the easier port if migration cost is the concern.
I'm filing this as a record of the issue in case it's useful for future maintenance, and so that downstream packagers running `cargo audit` have something to point at.
Happy to provide more detail on any of the above if helpful.
Cheers,
Michael Mendy.
关闭于 2026-05-20 1 条评论