Remove unused dev-dep cross

[jayvdb]

afaics, cross is not needed as a dev dependency.
It adds a lot of unnecessary dependencies to the lock file, including several CVEs.

[jtmoon79]

several CVEs.

How did you find the CVEs in cross? I'd like to review them.

[jtmoon79]

How did you find the CVEs in cross? I'd like to review them.

@jayvdb do you recall how you ran into this?

[jayvdb]

I use https://github.com/google/osv-scanner and https://github.com/EmbarkStudios/cargo-deny

cross-rs/cross#1578 is one of the CVEs

[jtmoon79]

@jayvdb I ran osv-scanner with cross and without cross in Cargo.toml. There was no difference.

Using osv-scanner version 1.9.0 on Ubuntu 22.04 at 9bbc405

$ cargo --version
cargo 1.73.0 (9c4383fb5 2023-08-26)

$ cargo clean && cargo build

$ osv-scanner scan -r .
...
╭─────────────────────────────────────┬──────┬───────────┬──────────────────┬─────────┬────────────────────────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE          │ VERSION │ SOURCE                         │
├─────────────────────────────────────┼──────┼───────────┼──────────────────┼─────────┼────────────────────────────────┤
│ https://osv.dev/RUSTSEC-2021-0145   │      │ crates.io │ atty             │ 0.2.14  │ Cargo.lock                     │
│ https://osv.dev/GHSA-g98v-hv3f-hcfr │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2024-0375   │      │ crates.io │ atty             │ 0.2.14  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2021-0153   │      │ crates.io │ encoding         │ 0.2.33  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2024-0384   │      │ crates.io │ instant          │ 0.1.13  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2022-0081   │      │ crates.io │ json             │ 0.12.4  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2024-0019   │ 7.5  │ crates.io │ mio              │ 0.7.14  │ Cargo.lock                     │
│ https://osv.dev/GHSA-r8w9-5wcg-vfj7 │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2024-0370   │      │ crates.io │ proc-macro-error │ 1.0.4   │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2024-0336   │ 7.5  │ crates.io │ rustls           │ 0.19.1  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2023-0052   │ 7.5  │ crates.io │ webpki           │ 0.21.4  │ Cargo.lock                     │
│ https://osv.dev/GHSA-8qv2-5vq6-g2g7 │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2021-0139   │      │ crates.io │ ansi_term        │ 0.12.1  │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/RUSTSEC-2021-0145   │      │ crates.io │ atty             │ 0.2.14  │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/GHSA-g98v-hv3f-hcfr │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2024-0375   │      │ crates.io │ atty             │ 0.2.14  │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/RUSTSEC-2024-0006   │      │ crates.io │ shlex            │ 0.1.1   │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/GHSA-r7qv-8r2h-pg27 │      │           │                  │         │                                │
╰─────────────────────────────────────┴──────┴───────────┴──────────────────┴─────────┴────────────────────────────────╯

# remove from `Cargo.toml` the line `cross = "0.2.5"`

$ cargo clean && cargo build

$ osv-scanner scan -r .
...
╭─────────────────────────────────────┬──────┬───────────┬──────────────────┬─────────┬────────────────────────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE          │ VERSION │ SOURCE                         │
├─────────────────────────────────────┼──────┼───────────┼──────────────────┼─────────┼────────────────────────────────┤
│ https://osv.dev/RUSTSEC-2021-0145   │      │ crates.io │ atty             │ 0.2.14  │ Cargo.lock                     │
│ https://osv.dev/GHSA-g98v-hv3f-hcfr │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2024-0375   │      │ crates.io │ atty             │ 0.2.14  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2021-0153   │      │ crates.io │ encoding         │ 0.2.33  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2024-0384   │      │ crates.io │ instant          │ 0.1.13  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2022-0081   │      │ crates.io │ json             │ 0.12.4  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2024-0019   │ 7.5  │ crates.io │ mio              │ 0.7.14  │ Cargo.lock                     │
│ https://osv.dev/GHSA-r8w9-5wcg-vfj7 │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2024-0370   │      │ crates.io │ proc-macro-error │ 1.0.4   │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2024-0336   │ 7.5  │ crates.io │ rustls           │ 0.19.1  │ Cargo.lock                     │
│ https://osv.dev/RUSTSEC-2023-0052   │ 7.5  │ crates.io │ webpki           │ 0.21.4  │ Cargo.lock                     │
│ https://osv.dev/GHSA-8qv2-5vq6-g2g7 │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2021-0139   │      │ crates.io │ ansi_term        │ 0.12.1  │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/RUSTSEC-2021-0145   │      │ crates.io │ atty             │ 0.2.14  │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/GHSA-g98v-hv3f-hcfr │      │           │                  │         │                                │
│ https://osv.dev/RUSTSEC-2024-0375   │      │ crates.io │ atty             │ 0.2.14  │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/RUSTSEC-2024-0006   │      │ crates.io │ shlex            │ 0.1.1   │ subprojects/bindgen/Cargo.lock │
│ https://osv.dev/GHSA-r7qv-8r2h-pg27 │      │           │                  │         │                                │
╰─────────────────────────────────────┴──────┴───────────┴──────────────────┴─────────┴────────────────────────────────╯

[jtmoon79]

I get the same warnings with cargo-deny when run with cross = "0.2.5" and without it.

Run on Ubuntu 22.04

$ cargo --version
cargo 1.73.0 (9c4383fb5 2023-08-26)

$ cargo deny --version
cargo-deny 0.16.2

$ (cargo clean && cargo build) &> /dev/null

$ cargo deny check --show-stats advisories ban bans sources
...
 advisories FAILED: 9 errors, 0 warnings, 0 notes
           bans ok: 0 errors, 15 warnings, 0 notes
        sources ok: 0 errors, 0 warnings, 0 notes

# remove `cross` from `Cargo.toml`

$ (cargo clean && cargo build) &> /dev/null

$ cargo deny check --show-stats advisories ban bans sources
...
 advisories FAILED: 9 errors, 0 warnings, 0 notes
           bans ok: 0 errors, 15 warnings, 0 notes
        sources ok: 0 errors, 0 warnings, 0 notes

[jtmoon79]

Closing.

Comments above note no difference with or without cross = "0.2.5" in Cargo.toml, using tools osv-scanner and cargo-deny.

Thanks for reporting @jayvdb 😄 . Please re-open if you can provide steps demonstrating a difference.