search

oxidecomputer / third-party-api-clients

A place for keeping all our generated third party API clients.
https://docs.rs/octorust
MIT License
132 stars 55 forks source link

disable chrono default-features #39

Closed matt-phylum closed 1 year ago

matt-phylum commented 1 year ago

chrono 0.4, for legacy reasons, has a dependency on time 0.1. time 0.1 has the potential for CVE-2020-26235.

This dependency can be avoided by turning off the default features. The build succeeds after changing this and disabling the Google clients (which use another library that brings in the default features I'm trying to avoid) so it looks like the other features were not being used directly here.

augustuswm commented 1 year ago

Thanks for adding this. I'll work on getting the remaining clients updated so they no longer activate the feature.