Start removing chrono
from dependencies
#645
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This leaves only
rcgen
as a 'root cause' for includingchrono
:We should keep an eye on rustls/rcgen#65, and update
qp2p
/qjsonrpc
when we can.76daf91 chore: upgrade
tracing-appender
andtracing-subscriber
These new versions have dropped their dependence on
chrono
, which hasan active security advisory against it (RUSTSEC-2020-0159) which seems
unlikely to be resolved.
chrono
is still being pulled in byqp2p
(viarcgen
),sn_api
, andsn_launch_tool
. This will be fixed in future commits.3fe040f chore(sn): upgrade
sn_launch_tool
The new version uses the upgraded versions of tracing which no longer
depend on
chrono
.f7e715a chore(sn_api): switch from
chrono
totime
Due to the active security advisory against chrono (RUSTSEC-2020-0159)
is makes sense to switch to a library that is not affected (though we
are not using the affected APIs in
chrono
).