Hi! First off, thanks for gds21! it's been genuinely useful, and it's one of the few solid GDSII libraries in the Rust ecosystem
I Wanted to flag something that's started showing up downstream rather than file it silently. My CI runs cargo deny / RustSec on every PR, and it's now failing on an unmaintained-dependency advisory that traces back through gds21:
gds21 0.2.0
└─ layout21utils 0.2.0
└─ serde_yaml 0.8.26 ← unmaintained (RUSTSEC-2024-0320, archived by the author)
└─ yaml-rust 0.4.5 ← unmaintained (RUSTSEC, 2024-03-20)
The advisory the bots point at is yaml-rust, but the actual root is serde_yaml 0.8. it was archived upstream in early 2024, and serde_yaml 0.8 is what pulls in the old yaml-rust. So replacing the YAML layer in layout21utils would clear both advisories at once.
To be clear, this isn't a security vulnerability (nothing's exploitable here), It's the "unmaintained" class of advisory. But for anyone gating CI on RustSec it's a recurring failure that has to be either suppressed with an explicit ignore or carried as a slowly-rotting transitive dep, so I figured it was worth raising upstream rather than papering over locally.
One way to address this is to migrate serde_yaml to a maintained, serde-compatible fork. serde_yaml_ng is the closest drop-in (same API surface, actively maintained) and, being on a current YAML backend, drops the yaml-rust 0.4 dependency entirely. If the YAML usage in layout21utils is a small surface, this is usually a near-mechanical swap.
Hi! First off, thanks for gds21! it's been genuinely useful, and it's one of the few solid GDSII libraries in the Rust ecosystem
I Wanted to flag something that's started showing up downstream rather than file it silently. My CI runs cargo deny / RustSec on every PR, and it's now failing on an unmaintained-dependency advisory that traces back through gds21:
The advisory the bots point at is yaml-rust, but the actual root is serde_yaml 0.8. it was archived upstream in early 2024, and serde_yaml 0.8 is what pulls in the old yaml-rust. So replacing the YAML layer in layout21utils would clear both advisories at once.
To be clear, this isn't a security vulnerability (nothing's exploitable here), It's the "unmaintained" class of advisory. But for anyone gating CI on RustSec it's a recurring failure that has to be either suppressed with an explicit ignore or carried as a slowly-rotting transitive dep, so I figured it was worth raising upstream rather than papering over locally.
One way to address this is to migrate serde_yaml to a maintained, serde-compatible fork. serde_yaml_ng is the closest drop-in (same API surface, actively maintained) and, being on a current YAML backend, drops the yaml-rust 0.4 dependency entirely. If the YAML usage in layout21utils is a small surface, this is usually a near-mechanical swap.