Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove chrono dependency #12

Closed
coderedart opened this issue Aug 26, 2023 · 3 comments
Closed

remove chrono dependency #12

coderedart opened this issue Aug 26, 2023 · 3 comments

Comments

@coderedart
Copy link

when i run cargo audit, i get this error

Crate:     time
Version:   0.1.45
Title:     Potential segfault in the time crate
Date:      2020-11-18
ID:        RUSTSEC-2020-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0071
Severity:  6.2 (medium)
Solution:  Upgrade to >=0.2.23
Dependency tree:
time 0.1.45
└── chrono 0.4.26
    └── arcdps 0.9.0
        └── jokolink 0.1.0
error: 1 vulnerability found!

chrono won't fix it chronotope/chrono#602 (comment)
and instead recommends people to wait for 0.5 release which has been going on since April chronotope/chrono#970 . Just like the Alliances :D

So, we have three options:

  1. wait for chrono 0.5 which might take a while
  2. directly use time crate, if possible.
  3. feature gate the uses of chrono. AFAIK it is only used for combat messages. and they can be enabled by an optional feature
@greaka
Copy link
Owner

greaka commented Aug 26, 2023

Chrono won't fix it because they aren't affected. As a result, I'm not in a hurry to fix it either. Feel free to open a PR though 🙂

@pitdicker
Copy link

The plan for chrono is to release a 0.4 version soon (I hope within weeks) that drops the time 0.1 dependency. It has been part of the public API, that is why it took so long. But we don't believe making the switch now would cause real-world breakage.

@greaka
Copy link
Owner

greaka commented Sep 13, 2023

cargo update fixes this issue
https://github.com/chronotope/chrono/releases/tag/v0.4.30

@greaka greaka closed this as completed Sep 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants