chrono is unmaintained and has a vulnerable dependency

[ghost]

someone asked about this over a month ago with no official reply. there have been some commits but no releases or fixes for reported vulnerabilities in the time dependency. there are many issues and prs for the time issue in the repo.

is it time for cargo audit to list this as unmaintained since its so widely used and not being properly cared for by the owner/maintainers?

chronotope/chrono#650

[tarcieri]

chrono is a high-profile crate so we should definitely do our due diligence. However I would agree there's a case to be made that it falls under the WIP guidelines for unmaintained crates being drafted in #1192.

I will ask for input from chrono maintainers on the linked issue in order to attempt to help determine next steps.

[tarcieri]

We have confirmation on chronotope/chrono#650 that chrono is maintained. Closing this.