Skip to content
This repository was archived by the owner on May 11, 2023. It is now read-only.

Bump Chrono to 0.4.22 and remove time 0.1 - #231

Merged
cloudhead merged 1 commit into
radicle-dev:masterfrom
pinkforest:bump/chrono-and-time
Aug 30, 2022
Merged

Bump Chrono to 0.4.22 and remove time 0.1#231
cloudhead merged 1 commit into
radicle-dev:masterfrom
pinkforest:bump/chrono-and-time

Conversation

@pinkforest

@pinkforest pinkforest commented Aug 24, 2022

Copy link
Copy Markdown
Contributor

Signed-off-by: Miss M MissM_signed@protonmail.ch

This PR resolves two below security advisories:

RUSTSEC-2020-0159, RUSTSEC-2020-0071 - When doing env & time same time - it's not thread safe

Chrono from 0.4.20 has a new maintainer and did a lot of fixes including RiR localtime_r 🥳

time 0.1 in turn is brought by chrono "oldtime" feature that is "optional" (but default) chrono dependency

default = ["clock", "std", "oldtime", "wasmbind"] -> oldtime = ["time"]

But time 0.1 was included via common & inspect as chrono was imported with default features

I've set the features explicitly leaving out oldtime that is not considered thread safe and wasmbind we don't need either

By specifying the feature explicitly we got rid of time 0.1 🥳

Then I had also - in order to bump the .lock more precisely for chrono 0.4.22 do:

$ cargo update -p chrono

    Updating crates.io index
    Updating chrono v0.4.19 -> v0.4.20

libc was holding back chrono bump to 0.4.22 so:

$ cargo update -p libc

    Updating crates.io index
    Updating libc v0.2.125 -> v0.2.132

$ cargo update -p chrono --precise 0.4.22

    Updating crates.io index
      Adding android_system_properties v0.1.4
    Updating chrono v0.4.20 -> v0.4.22
      Adding iana-time-zone v0.1.46
    Updating js-sys v0.3.57 -> v0.3.58
    Updating wasm-bindgen v0.2.80 -> v0.2.81
    Updating wasm-bindgen-backend v0.2.80 -> v0.2.81
    Updating wasm-bindgen-macro v0.2.80 -> v0.2.81
    Updating wasm-bindgen-macro-support v0.2.80 -> v0.2.81
    Updating wasm-bindgen-shared v0.2.80 -> v0.2.81

@pinkforest
pinkforest requested a review from cloudhead as a code owner August 24, 2022 19:46
This was referenced Aug 24, 2022
@pinkforest pinkforest changed the title Chrono to 0.4.22 and get rid of time 0.1 Bump Chrono to 0.4.22 and remove time 0.1 Aug 24, 2022
cloudhead
cloudhead previously approved these changes Aug 30, 2022

@cloudhead cloudhead left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing better than getting rid of dependencies

Signed-off-by: pinkforest <36498018+pinkforest@users.noreply.github.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants