Tracking issue for fixing chrono crate dependencies #20568
Labels
Comments
rillian
added
OS/Android
This was referenced Jan 21, 2022
bors bot
added a commit
to massalabs/massa
that referenced
this issue
Mar 8, 2022
2376: Fix security audit - get rid of chrono and use time directly r=AurelienFT a=AurelienFT Chrono still use a very old version of time (0.1 now it's 0.3). They have a PR running since months for updating but it seems that there is communication problems that lead to long time development. The PR : chronotope/chrono#639 This break our CI like a lot of others projects that use `cargo audit`. A lot of projects that use chrono to do things that are now implemented in the new version of `time` has switched to use `time` directly instead of using tokio. Some examples : - brave/brave-browser#20568 - meilisearch/milli#450 So as we also only use chrono to make things that now possible in `time` which is more maintained I suggest in this PR a change to use `time` instead of `chrono`. So that it will fix our CI and make us use a more maintained dependency. Fix #2374 Co-authored-by: AurelienFT <aurelien.foucault@epitech.eu>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
The popular
chronoRust crate v0.4.19 has two outstanding security advisories, RUSTSEC-2020-0071 and RUSTSEC-2020-0159 which upstream hasn't addressed after more than a year.Because the issue is specific to querying the local time, as opposed to date parsing, formatting, or calculations without reference to the local timezone, We have periodically audited uses of this crate and then ignored these specific advisories.
This is time consuming and error prone, so we'd like our own code and dependencies to migrate to other crates for the same functionality. This is happening to some extent, with newer versions of the
timecrate taking up some of the slack.This issue is for tracking related work.
Follow-up to #18835
Tasks
chronoSpeedreader: cargo audit fails #19330chrono[Draft] Address SKU dependency issues brave-core#11874time. Currently it only supports RFC 3339.The text was updated successfully, but these errors were encountered: