Repository: informalsystems/tendermint-rs (language: rust)

Issue:
RUSTSEC-2022-0054: wee_alloc is Unmaintained

> wee_alloc is Unmaintained

| Details             |                                                |
| ------------------- | ---------------------------------------------- |
| Status              | unmaintained                |
| Package             | `wee_alloc`                      |
| Version             | `0.4.5`                   |
| URL                 | [https://github.com/rustwasm/wee_alloc/issues/107](https://github.com/rustwasm/wee_alloc/issues/107) |
| Date                | 2022-05-11                         |

Two of the maintainers have indicated that the crate may not be maintained.

The crate has open issues including memory leaks and may not be suitable for production use.

It may be best to switch to the default Rust standard allocator on wasm32 targets.

Last release seems to have been three years ago.

## Possible Alternative(s)

 The below list has not been vetted in any way and may or may not contain alternatives;

 - Rust standard [default allocator] on wasm32-target

## Honorable Mention(s)

 The below may serve to educate on potential future alternatives:

 - [lol_alloc](https://crates.io/crates/lol_alloc)

[default allocator]: https://github.com/alexcrichton/dlmalloc-rs

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2022-0054.html) for additional details.



Discussion / hints:

Fix patch:
diff --git a/light-client-js/Cargo.toml b/light-client-js/Cargo.toml
index e6dd96278..284484932 100644
--- a/light-client-js/Cargo.toml
+++ b/light-client-js/Cargo.toml
@@ -34,12 +34,5 @@ wasm-bindgen = { version = "0.2.63", default-features = false, features = [ "ser
 # code size when deploying.
 console_error_panic_hook = { version = "0.1.6", default-features = false, optional = true }
 
-# `wee_alloc` is a tiny allocator for wasm that is only ~1K in code size
-# compared to the default allocator's ~10K. It is slower than the default
-# allocator, however.
-#
-# Unfortunately, `wee_alloc` requires nightly Rust when targeting wasm for now.
-wee_alloc = { version = "0.4.5", default-features = false, optional = true }
-
 [dev-dependencies]
 wasm-bindgen-test = { version = "0.3.13", default-features = false }
diff --git a/light-client-js/src/lib.rs b/light-client-js/src/lib.rs
index 2c67e5e65..32f38970d 100644
--- a/light-client-js/src/lib.rs
+++ b/light-client-js/src/lib.rs
@@ -22,12 +22,6 @@ use tendermint_light_client_verifier::{
 };
 use wasm_bindgen::{prelude::*, JsValue};
 
-// When the `wee_alloc` feature is enabled, use `wee_alloc` as the global
-// allocator.
-#[cfg(feature = "wee_alloc")]
-#[global_allocator]
-static ALLOC: wee_alloc::WeeAlloc<'_> = wee_alloc::WeeAlloc::INIT;
-
 /// Check whether a given untrusted block can be trusted.
 #[wasm_bindgen]
 pub fn verify(untrusted: &JsValue, trusted: &JsValue, options: &JsValue, now: &JsValue) -> JsValue {


Test patch: