I am curious if Deprecated functions in kotlin sta...
# kotlin-roadmapn
nikolaymetchev
08/02/2023, 9:48 AMI am curious if Deprecated functions in kotlin standard library are going to stay deprecated forever or if they will be removed eventually. I am think about this one: https://youtrack.jetbrains.com/issue/KT-43306/Deprecate-createTempFile-and-createTempDir-functions-in-kotlin.io in particular.
j
Joffrey
08/02/2023, 10:44 AMNormally the idea of deprecating functions is to delete them at some point. Either way, it's better not to use them at all.
n
nikolaymetchev
08/02/2023, 10:52 AMI guess I was wondering if it was decided when they would be deleted. Those still show up as security vulnerabilities in security scans
j
Joffrey
08/02/2023, 10:53 AMAh, that I don't know, sorry. You mean the whole stdlib is flagged even if those functions aren't used?
n
nikolaymetchev
08/02/2023, 10:57 AMk
Klitos Kyriacou
08/02/2023, 11:35 AMI too have come across this irritating issue. Snyk appears to be implying "consider not using the Kotlin standard library" 🙄. Yeah, as if.
But this vulnerability is not just in the Kotlin stdlib; it's also in the java.io.File class (which Kotlin uses for these deprecated functions). Yet Snyk doesn't warn you not to use the Java API. What have they got against Kotlin? Maybe it's because Kotlin actually deprecated these functions, but Java turned a blind eye and they're not yet deprecated?
☝️ 1
v
Vsevolod Tolstopyatov [JB]
08/03/2023, 6:23 PMWe usually don't completely remove stuff -- it's an irreversible binary incompatible change. Usually we just hide it or deprecate with error.
This function is no exception.
It's worth reporting this to scanning tool; it seems like even if we'll raise the deprecation level to
ERRORk
Klitos Kyriacou
08/03/2023, 8:21 PMTheir web page says:
Note: As of version 1.4.21, the vulnerable functions have been marked as deprecated. Due to still being useable, this advisory is kept as "unfixed".So if you do change the deprecation to ERROR so that it's unusable, they should by their own logic remove this advisory.
n
nikolaymetchev
08/03/2023, 8:23 PMCurious though, can't you just change the implementation to be the safe version that is recommended in the function docs?
k
Klitos Kyriacou
08/03/2023, 8:30 PMThat would break backwards compatibility as it would involve changing the behaviour of the function. (Even though it was bad behaviour, I don't think JetBrains would want to change it.)
g
gildor
07/02/2024, 5:19 AMThis report from Smyk is really strange, those methods would forever be available on java (or even JVM), what is even the point of it
➕ 2
45 Views