Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Start removing chrono from dependencies #645

Merged
merged 3 commits into from
Oct 26, 2021
Merged

Start removing chrono from dependencies #645

merged 3 commits into from
Oct 26, 2021

Conversation

connec
Copy link
Contributor

@connec connec commented Oct 26, 2021

This leaves only rcgen as a 'root cause' for including chrono:

chrono v0.4.19
├── rcgen v0.7.0
│   └── qjsonrpc v0.2.3
│       └── sn_api v0.38.0 (/Users/chris/repos/safe_network/sn_api)
├── rcgen v0.8.14
│   └── qp2p v0.24.0
│       └── safe_network v0.36.3 (/Users/chris/repos/safe_network/sn)
│           └── sn_api v0.38.0 (/Users/chris/repos/safe_network/sn_api)
├── yasna v0.3.2
│   └── rcgen v0.7.0 (*)
└── yasna v0.4.0
    └── rcgen v0.8.14 (*)

We should keep an eye on rustls/rcgen#65, and update qp2p/qjsonrpc when we can.


  • 76daf91 chore: upgrade tracing-appender and tracing-subscriber

    These new versions have dropped their dependence on chrono, which has
    an active security advisory against it (RUSTSEC-2020-0159) which seems
    unlikely to be resolved.

    chrono is still being pulled in by qp2p (via rcgen), sn_api, and
    sn_launch_tool. This will be fixed in future commits.

  • 3fe040f chore(sn): upgrade sn_launch_tool

    The new version uses the upgraded versions of tracing which no longer
    depend on chrono.

  • f7e715a chore(sn_api): switch from chrono to time

    Due to the active security advisory against chrono (RUSTSEC-2020-0159)
    is makes sense to switch to a library that is not affected (though we
    are not using the affected APIs in chrono).

@connec connec requested a review from a team as a code owner October 26, 2021 13:41
@connec connec temporarily deployed to approved_action October 26, 2021 13:41 Inactive
Chris Connelly added 3 commits October 26, 2021 16:01
These new versions have dropped their dependence on `chrono`, which has
an active security advisory against it (RUSTSEC-2020-0159) which seems
unlikely to be resolved.

`chrono` is still being pulled in by `qp2p` (via `rcgen`), `sn_api`, and
`sn_launch_tool`. This will be fixed in future commits.
The new version uses the upgraded versions of tracing which no longer
depend on `chrono`.
Due to the active security advisory against chrono (RUSTSEC-2020-0159)
is makes sense to switch to a library that is not affected (though we
are not using the affected APIs in `chrono`).
@connec connec temporarily deployed to approved_action October 26, 2021 15:03 Inactive
@connec connec changed the title chore: upgrade tracing-appender and tracing-subscriber Start removing chrono from dependencies Oct 26, 2021
@joshuef joshuef merged commit 442c1bd into maidsafe:main Oct 26, 2021
@connec connec deleted the upgrade-tracing branch October 26, 2021 15:57
@connec connec temporarily deployed to approved_action November 25, 2021 15:03 Inactive
@connec connec temporarily deployed to approved_action November 25, 2021 15:04 Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants