Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): do not enable default features of chrono #286

Merged
merged 1 commit into from
Jul 31, 2023
Merged

chore(deps): do not enable default features of chrono #286

merged 1 commit into from
Jul 31, 2023

Commits on Jul 26, 2023

  1. chore(deps): do not enable default features of chrono 

    Enabling the default features of chrono causes the time 0.1 crate to be
added as a transitive dependency.

This old version of time is affected by CVE RUSTSEC-2020-0071

Thanks to work done inside of chrono 0.4, there are high chances the
majority of the codebases do not actually need it.

Building sigstore with only the cosign feature prevents the inclusion of
the vulnerable time dependency.

This isn't unfortunately true when rekor is being used, because the
openid crate brings the transitive dependency back.

Signed-off-by: Flavio Castelli <[email protected]>
    @flavio
    flavio committed Jul 26, 2023
    Configuration menu
    Copy the full SHA
    b7be13e View commit details
    Browse the repository at this point in the history