search

daboross / fern

Simple, efficient logging for Rust
MIT License
848 stars 51 forks source link

switch from chrono to time #90

Closed Roguelazer closed 2 years ago

Roguelazer commented 2 years ago

It seems like chrono isn't going to be maintained any more and, in particular, is not going to have RUSTSEC-2020-0159 / RUSTSEC-2020-0071 fixed. I believe most folks are moving from chrono to time 0.3.

Note that time does not support strftime-style formatting language and instead has their own bespoke formatting language (see https://github.com/time-rs/time/issues/341).

BlackDex commented 2 years ago

Not sure if the time feature is used via chrono at all by fern. If not, then adding default-features = false, features ["clock"] to chrono would solve that dependency. That would at least solve the RUSTSEC-2020-0071 one.

Also, it looks like there is some activity at chrono the past few days/weeks also to try and fix the other CVE.

daboross commented 2 years ago

fern only uses chrono for examples, and doesn't recommend using any functions in chrono which depend on time, so I'm not too worried about this.

With that said, #91 changed the default features as you suggested BlackDex, so I believe this is resolved.

We could move back to time for examples, but given that it doesn't support strftime so we'd have to rebuild examples, and chrono seems to still be supported, it doesn't seem worth it to me.