chore(deps): do not enable default features of chrono #286
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Enabling the default features of chrono causes the time 0.1 crate to be added as a transitive dependency. This old version of time is affected by CVE RUSTSEC-2020-0071 Thanks to work done inside of chrono 0.4, there are high chances the majority of the codebases do not actually need it. Building sigstore with only the cosign feature prevents the inclusion of the vulnerable time dependency. This isn't unfortunately true when rekor is being used, because the openid crate brings the transitive dependency back. Signed-off-by: Flavio Castelli <[email protected]>
flavio
added a commit
that referenced
this pull request
Dec 13, 2023
What's Changed ============== * chore(deps): Update rstest requirement from 0.17.0 to 0.18.1 by @dependabot in #282 * chore(deps): do not enable default features of chrono by @flavio in #286 * chore(deps): Update pem requirement from 2.0 to 3.0 by @dependabot in #289 * conformance: add conformance CLI and action by @jleightcap in #287 * chore: fix clippy warnings by @flavio in #292 * chore(deps): Bump actions/checkout from 3.5.3 to 3.6.0 by @dependabot in #291 * chore(deps): Update tough requirement from 0.13 to 0.14 by @dependabot in #290 * chore(deps): update to latest version of picky by @flavio in #293 * chore(deps): Bump actions/checkout from 3.6.0 to 4.0.0 by @dependabot in #294 * chore: add repository link to Cargo metadata by @flavio in #297 * chore(deps): Update cached requirement from 0.44.0 to 0.45.1 by @dependabot in #298 * chore(deps): Bump actions/checkout from 4.0.0 to 4.1.0 by @dependabot in #302 * chore(deps): Update cached requirement from 0.45.1 to 0.46.0 by @dependabot in #301 * chore(deps): Update testcontainers requirement from 0.14 to 0.15 by @dependabot in #303 * chore(deps): Bump actions/checkout from 4.1.0 to 4.1.1 by @dependabot in #304 * cosign/tuf: use trustroot by @jleightcap in #305 * Fix broken tests, update deps by @flavio in #313 New Contributors ================ * @jleightcap made their first contribution in #287 **Full Changelog**: v0.7.2...v0.8.0 Signed-off-by: Luke Hinds <[email protected]> Co-authored-by: Flavio Castelli <[email protected]>
flavio
added a commit
that referenced
this pull request
Dec 13, 2023
What's Changed ============== * chore(deps): Update rstest requirement from 0.17.0 to 0.18.1 by @dependabot in #282 * chore(deps): do not enable default features of chrono by @flavio in #286 * chore(deps): Update pem requirement from 2.0 to 3.0 by @dependabot in #289 * conformance: add conformance CLI and action by @jleightcap in #287 * chore: fix clippy warnings by @flavio in #292 * chore(deps): Bump actions/checkout from 3.5.3 to 3.6.0 by @dependabot in #291 * chore(deps): Update tough requirement from 0.13 to 0.14 by @dependabot in #290 * chore(deps): update to latest version of picky by @flavio in #293 * chore(deps): Bump actions/checkout from 3.6.0 to 4.0.0 by @dependabot in #294 * chore: add repository link to Cargo metadata by @flavio in #297 * chore(deps): Update cached requirement from 0.44.0 to 0.45.1 by @dependabot in #298 * chore(deps): Bump actions/checkout from 4.0.0 to 4.1.0 by @dependabot in #302 * chore(deps): Update cached requirement from 0.45.1 to 0.46.0 by @dependabot in #301 * chore(deps): Update testcontainers requirement from 0.14 to 0.15 by @dependabot in #303 * chore(deps): Bump actions/checkout from 4.1.0 to 4.1.1 by @dependabot in #304 * cosign/tuf: use trustroot by @jleightcap in #305 * Fix broken tests, update deps by @flavio in #313 New Contributors ================ * @jleightcap made their first contribution in #287 **Full Changelog**: v0.7.2...v0.8.0 Signed-off-by: Luke Hinds <[email protected]> Co-authored-by: Flavio Castelli <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Enabling the default features of chrono causes the time 0.1 crate to be added as a transitive dependency.
This old version of time is affected by CVE RUSTSEC-2020-0071
Thanks to work done inside of chrono 0.4, there are high chances the majority of the codebases do not actually need it.
Building sigstore with only the cosign feature prevents the inclusion of the vulnerable time dependency.
This isn't unfortunately true when rekor is being used, because the openid crate brings the transitive dependency back.