Consider migrating off anymap, it contains undefined behavior

[erickt]

It appears that the anymap crate contains some undefined behavior that has been fixed in the repository, but was never published to crates.io. Unfortunately it appears the project has since been abandoned (chris-morgan/anymap#37, rustsec/advisory-db#906).

I'd recommend migrating off the project, especially since there still may be an opportunity to make api breaking changes before 5.0.0 is released. Unfortunately there isn't an officially recommended solution. There's https://github.com/azriel91/anymap2, which is a fork that includes the fix, but I'd reconsider a more straightforward approach, where the event type uses serde-value to communicate arbitrary values.

struct Event {
    ...

    // Use an option-box to make it a single pointer sized
    pub attrs: Option<Box<EventAttrs>>,
}

struct EventAttrs {
    pub tracker: Tracker,
    pub info: Info,
    pub flag: Flag,
    pub extra: HashMap<String, serde_value::Value>,
}

Or if you want to still support arbitrary types, you could implement your own AnyMap, since TypeId is hashable.

[erickt]

How important is it that the attrs field support arbitrary types? It looks like the type internally only stores strings and integer-like types into the field. This field is unfortunately a public property, so it'd be non-trivial to discover if downstream users are stuffing in other items into the attrs field.