Consider releasing a patch to the v2 release line that addresses a panic that is widespread across the ecosystem

[lopopolo]

This line in clap v2 means that all apps that use the convenience API App::get_matches_from do the wrong thing by default when stdout is closed.

clap/src/errors.rs

Line 401 in 0c7da9f

writeln!(&mut out.lock(), "{}", self.message).expect("Error writing Error to stdout");

From what I can tell, it looks like v3 suppresses all failures from writing to stdout in this flow.

Would the clap maintainers consider pushing a point release to v2 to remove this expect? Without it, the only way to address all of these bugs I've filed is to either:

• Move away from the convenience API
• Migrate to clap v3, which is not yet released.

Impact:

• [BUG] hyperfine -h panics when stdout is closed sharkdp/hyperfine#453
• [BUG] fd -h panics when stdout is closed sharkdp/fd#897
• starship -h panics if stdout is closed starship/starship#3280
• [BUG] tokei -h panics when stdout is closed XAMPPRocky/tokei#856
• procs --help panics when stdout is closed dalance/procs#210
• dust -h panics when stdout is closed bootandy/dust#199
• volta -h panics when stdout is closed volta-cli/volta#1055

I stopped filing bugs but this also impacts these other Rust binaries I happen to have installed:

• cargo
• cargo-deny
• cargo-about
• cargo-expand
• flamegraph
• bindgen
• cargo-bisect-rustc
• cargo-fuzz
• cargo-hakari
• cargo-tally
• cargo-udeps
• ucd-generate

[epage]

Could you expand on the end-user impact of this?

• How did you find this? How likely is someone else going to run into this?
• Why do you feel this is critical? How does this effect people?

I only found this issue a couple months ago when reading ripgrep's source code and opened #2659. It looks like no one had reported this before then which makes it seem like the impact is relatively small which makes it harder to justify creating a new clap2 release. You can look at https://github.com/clap-rs/clap/milestone/76 to see how close a clap3 release is.

(to be clear, this is not a "no", I'm not in a position to say that, but trying to extract the information that will better make your case and help in decision making)

[kbknapp]

v2.33.4 has been released that fixes this panic. To be clear, this was a pretty big exception to the rule of not going back to v2 except for security bugs. Panics could be seen as security issues if you tilt your head. Also, the fix was extremely trivial (essentially a single line change) so the effort involved in releasing that patch was minimal and non-disruptive for a pretty wide gain.

[lopopolo]

thank you!