Remove ring subsubdependency when using actix-multipart.

[simlay]

This is related to #741.

Setting the default features to false seems like an anti-pattern but it doesn't seem to be a feature to disable single features in cargo yet.

[fafhrd91]

You can disable default features in your project. actix-multipart is not appropriate place to do that

[simlay]

I know I can disable default features in my project. The issue is that actix-multipart re-enables the secure-cookies feature in actix-web which results in actix-http using ring.

For example, if I start with the following Cargo.toml

[package]
name = "foobar"
version = "0.1.0"
authors = ["simlay <simlay@localhost>"]
edition = "2018"

[dependencies]
actix-web = { version = "1.0.0", default-features = false }
actix-multipart = "0.1.2"

and swap out actix-multipart with my branch as found here:

[package]
name = "foobar"
version = "0.1.0"
authors = ["simlay <simlay@localhost>"]
edition = "2018"

[dependencies]
actix-web = { version = "1.0.0", default-features = false }
actix-multipart = { git = "https://github.com/simlay/actix-web.git", path = "actix-multipart", branch = "actix_multipart_default_dependencies" }

Then run I run cargo update and get:

    Updating git repository `https://github.com/simlay/actix-web.git`
    Updating crates.io index
      Adding actix-multipart v0.1.3 (https://github.com/simlay/actix-web.git?branch=actix_multipart_default_dependencies#b836e536)
    Removing actix-multipart v0.1.2
    Removing adler32 v1.0.3
    Removing awc v0.2.1
    Removing brotli-sys v0.3.2
    Removing brotli2 v0.3.2
    Removing build_const v0.2.1
    Removing crc v1.8.1
    Removing crc32fast v1.2.0
    Removing flate2 v1.0.7
    Removing miniz-sys v0.1.12
    Removing miniz_oxide v0.2.1
    Removing miniz_oxide_c_api v0.2.1
    Removing ring v0.14.6
    Removing spin v0.5.0
    Removing untrusted v0.6.2

Which removes ring from the Cargo.lock as desired.

Therefore, implying that the default features are re-enabled by actix-multipart without my change. How else does one fix this?

[fafhrd91]

seems it is not possible to disable default features

[fafhrd91]

could you update changes.md

[fafhrd91]

thanks

[PoiScript]

Hello, sorry to bother your. Could you publish actix-multipart 0.1.3 to the crates.io? It still stays in 0.1.2.

[fafhrd91]

actix-web 1.0.2 does not depend on ring by default anymore

[PoiScript]

Actually, I'm using actix-web without any default features right now. But I still getting many unused dependencies from actix-multipart. So I want to upgrade to actix-multipart 0.1.3 and get rid of them.