Refinery dependency on chrono leads to security issues

[vn971]

Hi. Currently, refinery_core depends on chrono: https://github.com/rust-db/refinery/blob/main/refinery_core/Cargo.toml#L22

chrono in turn seems to have a security issue that isn't fixed for a long while already: https://rustsec.org/advisories/RUSTSEC-2020-0159
Which is raised in the bug tracker as well (see also the last comments there): chronotope/chrono#499

Currently many libraries are evaluating ways to move away from chrono, such as depending on time directly (example).

Question: is it possible for refinery_core to not depend on chrono and thus eliminate the troublesome library from its dependencies? What can we do?

[jxs]

Hi, and thanks for your interest! Yeah I plan to add cargo-audit to the repo and fix this issue, which will probably be switching chrono to time as you suggested. Or do you want to go ahead and submit a PR?
thanks!

[vn971]

@jxs thanks for the response! Unfortunately I'm working with refinery in a company context, and our company is very small (I'm the only Rust dev there). There are no resources to spend there at all. So sorry for that, but still thanks for the project!

[jxs]

Hi, no worries :) It's fixed now. I will also add cargo-audit to the pipeline in the next days and probably cut a new release.
cheers :)

[vn971]

Yaay, thanks! 🎉