Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

switch to time from chrono #36

Closed
wants to merge 2 commits into from
Closed

switch to time from chrono #36

wants to merge 2 commits into from

Conversation

cardoe
Copy link
Owner

@cardoe cardoe commented Feb 5, 2022

chrono is no longer maintained and has a long standing security issue in
it. Switched to time to resolve the security issue. fixes #31.

Disable cargo incremental for CI builds and get backtrace info.
@cardoe cardoe force-pushed the time branch 2 times, most recently from d212b62 to 7743cab Compare February 5, 2022 06:25
chrono is no longer maintained and has a long standing security issue in
it. Switched to time to resolve the security issue. fixes #31.
@cardoe
Copy link
Owner Author

cardoe commented Feb 5, 2022

Unfortunately the time crate appears to only support second resolution in their formatting and nothing sub-second per https://github.com/time-rs/time/blob/d26562b930aa59ab4934ef6eb790474ff506126b/src/format/parse_items.rs#L55

@virtualritz
Copy link

chrono is no longer maintained [...]

chrono seems actively maintained to me.
Since I rely on this crate a lot in production critical code and would need to switch if what you write was true: can you substantiate this claim?

@cardoe
Copy link
Owner Author

cardoe commented Apr 8, 2022

Certainly at the time of my comment it was valid. It had 0 commits and 0 comments on issues by maintainers for 4 months and the preceding year it only had about a dozen commits. There were a few opened issues asking if it was maintained with no comments and folks in the Rust community were recommending switching back to time 0.3.

Given it getting maintenance again I’ll retire this PR and move forward with an updated release.

@cardoe
Copy link
Owner Author

cardoe commented Apr 8, 2022

You can see issues like rustsec/advisory-db#1216 which have been calling into question it’s maintained status.

@cardoe
Copy link
Owner Author

cardoe commented Apr 8, 2022

chronotope/chrono#650 (comment) It appears to be more revived around Feb 27th.

@cardoe
Copy link
Owner Author

cardoe commented Jul 2, 2022

We've yet to see a chrono release since work restarted on the project.

@cardoe cardoe closed this Jul 3, 2022
@cardoe cardoe deleted the time branch July 3, 2022 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Chrono dependency involves insecure version
2 participants