You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Github throws a dependabot alert for any projects that use wee_alloc:
Two of the maintainers have indicated that the crate may not be maintained.
The crate has open issues including memory leaks and may not be suitable for production use.
It may be best to switch to the default Rust standard allocator on wasm32 targets.
Last release seems to have been three years ago.
This means that somebody who follows the quickstart and does wasm-pack new hello-wasm then pushes to GH immediately gets a security alert - not great for user experience.
I am in support of this. Packages being out of date in this template caused me some issues when running through the wasm game of life tutorial book. The documentation in the book should also have references to wee_alloc removed.
Github throws a dependabot alert for any projects that use wee_alloc:
This means that somebody who follows the quickstart and does
wasm-pack new hello-wasm
then pushes to GH immediately gets a security alert - not great for user experience.The repo is in a pretty unfortunate state anyway https://github.com/rustwasm/wee_alloc
See also: discussion about the RUSTSEC advisory rustsec/advisory-db#1394
The text was updated successfully, but these errors were encountered: