Skip to content

Commit

Permalink
[smithy-rs] Fix cargo audit issue on chrono (#1907)
Browse files Browse the repository at this point in the history
* Avoid the chrono crate depending on the time crate

This commit is in response to RUSTSEC-2020-0071 where there is a
potential segfault in the time crate. The aws-smithy-types-convert
crate now disables the default features of the chrono crate so that
it will not depend on the time crate.

* Depend on lambda_http without RUSTSEC-2020-0071

This commit updates the version of lambda_http used by aws-smithy-http-server
and aws-smithy-http-server-python to 0.7.0. The prior version 0.6.0 of
lambda_http used the chrono crate in a way that exposed a security issue
described in RUSTSEC-2020-0071. By switching to 0.7.0 of lambda_http, those
two crates do not exhibit vulnerabilities as reported by cargo audit.

* Bump minor version of lambda_http in pokemon-service

This commit updates the version of `lambda_http` used by `pokemon-service`
from 0.6.0 to 0.7.0. This is in sync with the fact that both
`aws-smithy-http-server` and `aws-smithy-http-server-python` now depend
on 0.7.0 of `lambda_http`. Failing to do so would cause `pokemon-service`
to fail to compile due to an error at `lambda_http::run(handler)` in the
main function of the `pokemon-service-lambda` binary:
the trait `Service<lambda_http::http::Request<lambda_http::Body>>` is not
implemented for `LambdaHandler<aws_smithy_http_server::routing::Router>`

* Depend on lambda-http 0.7.1

This commit updates the version of `lambda_http` from 0.7.0 to 0.7.1 in
the crates within the top-level `rust-runtime` workspace. These updates
are needed to solve the issue described in awslabs/aws-lambda-rust-runtime#556

* Update CHANGELOG.next.toml

* Address smithy-lang/smithy-rs#1907

Co-authored-by: Saito <awsaito@c889f3b5ddc4.ant.amazon.com>
Co-authored-by: Zelda Hessler <zhessler@amazon.com>
  • Loading branch information
3 people authored and aws-sdk-rust-ci committed Dec 14, 2022
1 parent 83cd33a commit 13debd6
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 2 deletions.
2 changes: 2 additions & 0 deletions sdk/aws-smithy-types-convert/Cargo.toml
Expand Up @@ -23,6 +23,8 @@ version = "0.51.0"
[dependencies.chrono]
version = "0.4.19"
optional = true
default-features = false
features = ["std"]

[dependencies.time]
version = "0.3.4"
Expand Down
4 changes: 2 additions & 2 deletions versions.toml
@@ -1,4 +1,4 @@
smithy_rs_revision = '4c852b1d0b4456493869db13a934eecb5c81657b'
smithy_rs_revision = 'f0b7f55bf515f85bdb72975f355e297badc8a2f4'
aws_doc_sdk_examples_revision = 'f88a0edba3961f9d978bf1727054c9414e4fca2b'

[manual_interventions]
Expand Down Expand Up @@ -1976,7 +1976,7 @@ source_hash = '468361bba3a588959443cb5fb71680a6688f7cccb2f2e3201edc9613ee6d5952'
[crates.aws-smithy-types-convert]
category = 'SmithyRuntime'
version = '0.51.0'
source_hash = '47874f8822fa4c70b759b752c340add633d6b0857095079d5393c659da76b2b0'
source_hash = '0702131196d06d3c0f0a43b004cb28be7938923d2b0b39e8b9d17e2611d10caf'

[crates.aws-smithy-xml]
category = 'SmithyRuntime'
Expand Down

0 comments on commit 13debd6

Please sign in to comment.