Skip to content

Conversation

@jimblandy
Copy link
Member

Currently other components in Firefox are using ron 0.11.0. Ron 0.12 looks fine, but it adds a dependency on the typeid crate, which seems tricky to audit. We can do this, but for the sake of allowing Firefox to take critical wgpu updates, we should put it off for a bit.

Currently other components in Firefox are using ron 0.11.0. Ron 0.12
looks fine, but it adds a dependency on the typeid crate, which seems
tricky to audit. We can do this, but for the sake of allowing Firefox
to take critical wgpu updates, we should put it off for a bit.
@ErichDonGubler
Copy link
Member

RE: typeid: I mean, it's made by David Tolnay, and he's generally considered a trusted Rust crate author. Is that really a big blocker?

Copy link
Member

@cwfitzgerald cwfitzgerald left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since it seems like no code changes are needed, could we take a range dependency?

@jimblandy
Copy link
Member Author

Actually, I think I understand what ron 0.12 is doing now, and I've read typeid, so I think we can just take the upgrade.

@jimblandy jimblandy closed this Dec 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants