Repository navigation
🔒️ Drop the unmaintained ttf-parser (RUSTSEC-2026-0192) - #38
Merged
Merged
Conversation
RUSTSEC-2026-0192: ttf-parser is unmaintained and will get no fixes; the weekly Security workflow (cargo audit) has warned about it since 2026-09-21. There is no patched release — the advisory points to skrifa. It reached SensorView through one path only: eframe's default `winit/default` -> winit `wayland-csd-adwaita` -> sctk-adwaita `ab_glyph` -> owned_ttf_parser -> ttf-parser, i.e. the text of the client-side title bar on Wayland. egui's own text rendering does not use it. eframe now takes its default features minus `winit/default`, and winit is listed directly with its remaining defaults (`wayland-dlopen`) and `wayland-csd-adwaita-notitle` — the same Adwaita decorations without the title text. ab_glyph, ab_glyph_rasterizer, owned_ttf_parser and ttf-parser leave Cargo.lock. Trade-off: on GNOME under Wayland (the only common compositor that makes clients draw their own decorations) the title bar has no title text. KDE/wlroots use server-side decorations; macOS and Windows are unaffected — these winit features are Linux-only. Recorded in TODO.md with the condition for restoring titles (sctk-adwaita >= 0.11, which can render them with skrifa). Verified: cargo audit no longer reports RUSTSEC-2026-0192; cargo test passes; clippy -D warnings on default, '', gui, gui+web and web+push+tui; cargo check for Linux and Windows with the GUI; the macOS GUI launches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the unmaintained
ttf-parser(RUSTSEC-2026-0192) from the dependency tree. The advisory has no patched release; it recommendsskrifa.It came in through one path only: Linux Wayland title bars.
eframe's default
winit/default→ winitwayland-csd-adwaita→sctk-adwaitaab_glyph→owned_ttf_parser→ttf-parser. egui's own text rendering doesn't use it.The change:
winit/default.wayland-dlopen) andwayland-csd-adwaita-notitle. That gives the same Adwaita client-side decorations, minus the title text.ab_glyph,ab_glyph_rasterizer,owned_ttf_parserandttf-parserleaveCargo.lock.On GNOME under Wayland, the window title bar shows no title text. GNOME is the common compositor that makes clients draw their own decorations.
TODO.md records when titles can come back: once egui's winit can use
sctk-adwaita≥ 0.11, which renders them withskrifa.If a missing title on GNOME is worse than an "unmaintained" warning, close this PR instead. The alternative is to accept the advisory with a written reason in the audit config until egui upgrades winit.
Test plan
cargo audit: RUSTSEC-2026-0192 no longer reportedcargo tree -i ttf-parser --target allfinds nothingcargo test: 200 passed-D warnings: default, none,gui,gui,web,web,push,tuicargo checkfor Linux and Windows with the GUI enabled🤖 Generated with Claude Code