RUSTSEC-2023-0089: atomic-polyfill is unmaintained

[github-actions]

Details
Package	atomic-polyfill
Version	1.0.3
Warning	unmaintained
URL	embassy-rs/atomic-polyfill@48e55c1
Patched Versions	n/a

The author has archived the GitHub repository and mentions deprecation in
project's
README.

Possible alternatives

• portable-atomic

[traycerai]

Plan

Observations

The DaemonEye project has encountered RUSTSEC-2023-0089 advisory for the unmaintained atomic-polyfill crate (v1.0.3). This is a transitive dependency, not directly declared in any workspace Cargo.toml files. The project uses cargo-deny and cargo-audit for dependency security scanning with strict policies. The deny.toml configuration sets unmaintained crates to "workspace" level warnings and already has one ignored advisory (RUSTSEC-2025-0141 for bincode).

Approach

The solution involves a two-phase approach: first, identify the dependency chain bringing in atomic-polyfill, then either update the parent dependency to a version using portable-atomic or temporarily acknowledge the advisory with proper justification. This aligns with the project's existing security practices seen in file:deny.toml where similar advisories are documented with clear rationale.

Implementation Steps

Phase 1: Identify the Dependency Chain

1. Investigate the dependency tree

   • Run cargo tree -i atomic-polyfill in the workspace root to identify which dependency is pulling in atomic-polyfill
   • Document the complete dependency chain (e.g., your-crate -> dependency-x -> atomic-polyfill)
   • Check the versions of all dependencies in the chain

2. Research available updates

   • For each dependency in the chain, check if newer versions exist that have migrated to portable-atomic
   • Visit the repository/changelog of the parent dependency to verify migration status
   • Common candidates to check: interprocess, nix, or any embedded/low-level crates in the dependency tree

Phase 2: Resolution Strategy

Option A: Update Parent Dependency (Preferred)

3. Update the parent dependency

   • If a newer version of the parent dependency uses portable-atomic, update it in the appropriate workspace member's Cargo.toml
   • Likely candidates: file:daemoneye-eventbus/Cargo.toml (uses interprocess), file:daemoneye-lib/Cargo.toml (uses interprocess)
   • Update the version constraint in [workspace.dependencies] section of file:Cargo.toml if the dependency is defined there

4. Verify the update

   • Run cargo update to refresh the dependency tree
   • Run cargo tree -i atomic-polyfill again to confirm atomic-polyfill is no longer in the tree
   • Run cargo deny check advisories to verify the advisory is resolved
   • Run cargo audit to ensure no new advisories are introduced

Option B: Acknowledge Advisory (If Update Not Available)

5. Add advisory to ignore list with justification

   • If no parent dependency update is available, add RUSTSEC-2023-0089 to the ignore array in file:deny.toml (line 94)
   • Follow the existing pattern seen with RUSTSEC-2025-0141
   • Include a comment explaining:
     • Which dependency chain brings in atomic-polyfill
     • Why it cannot be updated currently
     • The risk assessment (unmaintained but not a security vulnerability)
     • A TODO to revisit when parent dependency updates

   Example entry:

   # atomic-polyfill: Unmaintained but pulled in by [dependency-name] v[version].
   # Not a security vulnerability, just unmaintained. The parent dependency
   # has not yet migrated to portable-atomic.
   # TODO: Monitor [dependency-name] for updates that use portable-atomic.
   "RUSTSEC-2023-0089",

Phase 3: Validation and Documentation

6. Run security checks

   • Execute cargo deny check to ensure all checks pass
   • Execute cargo audit to verify advisory handling
   • Execute cargo test across all workspace members to ensure functionality is preserved

7. Update security documentation

   • If the advisory was added to the ignore list, document the decision in file:SECURITY.md
   • Include the rationale and monitoring plan for future resolution

8. Verify CI/CD pipeline

   • Ensure the changes pass all CI checks
   • Confirm that security scanning tools in the pipeline accept the resolution

Success Criteria

• cargo tree -i atomic-polyfill returns no results (Option A) OR
• cargo deny check advisories passes with the advisory properly acknowledged (Option B)
• All existing tests continue to pass
• No new security advisories are introduced
• Documentation reflects the current state and future plans

Import In IDE

🤖 Prompt for AI Agents

## Observations

The DaemonEye project has encountered RUSTSEC-2023-0089 advisory for the unmaintained `atomic-polyfill` crate (v1.0.3). This is a transitive dependency, not directly declared in any workspace `Cargo.toml` files. The project uses `cargo-deny` and `cargo-audit` for dependency security scanning with strict policies. The `deny.toml` configuration sets unmaintained crates to "workspace" level warnings and already has one ignored advisory (RUSTSEC-2025-0141 for bincode).

## Approach

The solution involves a two-phase approach: first, identify the dependency chain bringing in `atomic-polyfill`, then either update the parent dependency to a version using `portable-atomic` or temporarily acknowledge the advisory with proper justification. This aligns with the project's existing security practices seen in `file:deny.toml` where similar advisories are documented with clear rationale.

## Implementation Steps

### Phase 1: Identify the Dependency Chain

1. **Investigate the dependency tree**
   - Run `cargo tree -i atomic-polyfill` in the workspace root to identify which dependency is pulling in `atomic-polyfill`
   - Document the complete dependency chain (e.g., `your-crate -> dependency-x -> atomic-polyfill`)
   - Check the versions of all dependencies in the chain

2. **Research available updates**
   - For each dependency in the chain, check if newer versions exist that have migrated to `portable-atomic`
   - Visit the repository/changelog of the parent dependency to verify migration status
   - Common candidates to check: `interprocess`, `nix`, or any embedded/low-level crates in the dependency tree

### Phase 2: Resolution Strategy

**Option A: Update Parent Dependency (Preferred)**

3. **Update the parent dependency**
   - If a newer version of the parent dependency uses `portable-atomic`, update it in the appropriate workspace member's `Cargo.toml`
   - Likely candidates: `file:daemoneye-eventbus/Cargo.toml` (uses `interprocess`), `file:daemoneye-lib/Cargo.toml` (uses `interprocess`)
   - Update the version constraint in `[workspace.dependencies]` section of `file:Cargo.toml` if the dependency is defined there

4. **Verify the update**
   - Run `cargo update` to refresh the dependency tree
   - Run `cargo tree -i atomic-polyfill` again to confirm `atomic-polyfill` is no longer in the tree
   - Run `cargo deny check advisories` to verify the advisory is resolved
   - Run `cargo audit` to ensure no new advisories are introduced

**Option B: Acknowledge Advisory (If Update Not Available)**

5. **Add advisory to ignore list with justification**
   - If no parent dependency update is available, add RUSTSEC-2023-0089 to the `ignore` array in `file:deny.toml` (line 94)
   - Follow the existing pattern seen with RUSTSEC-2025-0141
   - Include a comment explaining:
     - Which dependency chain brings in `atomic-polyfill`
     - Why it cannot be updated currently
     - The risk assessment (unmaintained but not a security vulnerability)
     - A TODO to revisit when parent dependency updates

   Example entry:
   ```toml
   # atomic-polyfill: Unmaintained but pulled in by [dependency-name] v[version].
   # Not a security vulnerability, just unmaintained. The parent dependency
   # has not yet migrated to portable-atomic.
   # TODO: Monitor [dependency-name] for updates that use portable-atomic.
   "RUSTSEC-2023-0089",
   ```

### Phase 3: Validation and Documentation

6. **Run security checks**
   - Execute `cargo deny check` to ensure all checks pass
   - Execute `cargo audit` to verify advisory handling
   - Execute `cargo test` across all workspace members to ensure functionality is preserved

7. **Update security documentation**
   - If the advisory was added to the ignore list, document the decision in `file:SECURITY.md`
   - Include the rationale and monitoring plan for future resolution

8. **Verify CI/CD pipeline**
   - Ensure the changes pass all CI checks
   - Confirm that security scanning tools in the pipeline accept the resolution

## Success Criteria

- `cargo tree -i atomic-polyfill` returns no results (Option A) OR
- `cargo deny check advisories` passes with the advisory properly acknowledged (Option B)
- All existing tests continue to pass
- No new security advisories are introduced
- Documentation reflects the current state and future plans

---

Execution Information

Branch: main
Commit: 3a90019

---

💡 Tips

Supported Commands (Inside Comments)

• Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

• Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
• Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

Warning

Something went wrong while processing your request.

Reference ID: d7cb0f1e-bd5b-4e20-a742-1af99bbcf154

Please try again or contact support if the issue persists, referencing this ID.