remove ouroboros
dependencies
`ouroboros v0.18.5` is used in exactly one place:
- `kernel/src/<device_tree.rs>` — one `#[ouroboros::self_referencing]` struct
## Why remove it
- the crate has had soundness concerns raised publicly and the original maintainer stepped down.
- It pulls in 6 extra transitive crates that exist solely to support it:
`aliasable`, `ouroboros_macro`, `proc-macro2-diagnostics`, `yansi`, `heck v0.4.1`, `version_check`
- The `heck v0.4.1` it brings in is a *second* version of heck alongside `v0.5.0` already used elsewhere.
## Suggested replacement
Replace with [`self_cell`](<https://crates.io/crates/self_cell>), which is a sounder, actively maintained alternative with a much smaller dep footprint, or restructure `DeviceTree` to avoid the self-reference entirely (e.g. store byte offsets / indices instead of borrows).
## Impact
Removing ouroboros eliminates 6 transitive crates in one shot.
0 条评论