Stop pinning syntect version

[ignatenkobrain]

Hello,

maintainer of zola in Fedora here. I am working on upgrading our package to 0.9.0 and I found that you have pinned syntect to 3.2.0 in a6db79f.

I would like to ask you to return it back to 3 and use some other way of pinning it instead. From what I understand you have it because of CI. So you can put something like cargo update -p syntect --precise 3.2.0 in the CI scripts.

Thank you for working on Zola and hope that we can find consensus for resolving this bug :)

[Keats]

A newer version of syntect pulls the latest version of rust-onig which pulls bindgen which requires llvm/clang, which would make zola hard to build for everyone, not just CI

I'll unpin as soon as a new version of onig that can disable bindgen is released (rust-onig/rust-onig#126) or trishume/syntect#270 is working.

[ignatenkobrain]

Thanks for replying. Yeah, that bindgen was introduced because of my bug (when onig-rs was segfaulting due to oniguruma update in Fedora). I see the point now. Also moving away from non-rust deps would be nice as well :)

For now I'll just keep downstream patch. Thanks!

[meithecatte]

I noticed while packaging zola for Guix: syntect 3.2.0, as pinned, requires onig ^4.1, which is incompatible with onig 5.0. The latter includes oniguruma 6.9.4, which fixed 7 CVEs since the oniguruma 6.9.1 shipped by onig 4.3.3, the latest semver-compatible version.

TL;DR: zola might be shipping 7 vulns due to this.

[Keats]

Still waiting for either syntect with fancy-regex or a new version of onig before unpinning.

[trishume]

The fancy-regex mode was just merged and released as v4.0.0! You may want to try using it to fix this issue, although it does halve performance so you may only want to use it on platforms where it's needed.

Still hoping that onig's build will eventually improve but for now fancy-regex is a good option.

[Keats]

Great i'll try it asap! Right now onig requires llvm on each platform so it's really usable at all :/

[Keats]

0.11 goes back to the most recent syntect version