Skip to content

Conversation

@PurpleBooth
Copy link
Contributor

Currently chrono has a vulnerability in it. This switches to the
underlying time-rs library that chrono uses.

https://rustsec.org/advisories/RUSTSEC-2020-0159

src/date.rs Outdated
let datetime: DateTime<Utc> = self.inner.into();
datetime.to_rfc3339_opts(SecondsFormat::Secs, true)
let datetime: OffsetDateTime = self.inner.into();
return datetime.format(&Rfc3339).unwrap_or_default();
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably just be an unwrap(). I can't see why it would fail, and if it does I'd rather panic than output an invalid plist.

@ebarnard
Copy link
Owner

The minimum Rust version in .github/workflows/build-and-test.yml needs to be bumped to 1.43.0

@ebarnard
Copy link
Owner

🤦 should have just looked at time.rs on GitHub. Their MSRV is 1.51.0 so ours will have to be as well.

Currently chrono has a vulnerability in it. This switches to the
underlying time-rs library that chrono uses.

https://rustsec.org/advisories/RUSTSEC-2020-0159

BC BREAK: this raises the minimum supported rust version to 1.51.0
@ebarnard
Copy link
Owner

Thanks

@ebarnard ebarnard merged commit 9ed64da into ebarnard:master Oct 20, 2021
@PurpleBooth PurpleBooth deleted the remove-dependency-on-chrono branch October 20, 2021 18:34
@extrawurst
Copy link

@ebarnard great that plist has merged a fix for this already! can we have a patch release containing it? that would be highly appreciated ❤️

@ebarnard
Copy link
Owner

I suppose we need to decide what the MSRV policy is. The time-rs change bumped it up by a year and a quarter to a release from March this year. My gut feeling is this should go in a minor release along with #70 once I've had a chance to get that working with Date and Uid.

@ebarnard
Copy link
Owner

Released in v1.3.0.

Enselic added a commit to Enselic/syntect that referenced this pull request Nov 22, 2021
A recent release of plist bumped MSRV to 1.51 (see
ebarnard/rust-plist#72 and discussions theirin), so we
need to do that as well to fix this build error in CI:

```
error: failed to parse manifest at `/home/runner/.cargo/registry/src/github.com-1ecc6299db9ec823/time-0.3.5/Cargo.toml`

Caused by:
  feature `resolver` is required

  this Cargo does not support nightly features, but if you
  switch to nightly channel you can add
  `cargo-features = ["resolver"]` to enable this feature
```
dandavison added a commit to dandavison/delta that referenced this pull request Nov 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants