Skip to content

Commit

Permalink
chore(deps): remove transitive dependency on chrono
Browse files Browse the repository at this point in the history
chrono is a worrying crate to depend on, because it depends on old
versions of the time crate with known security problems. PackSquash is
not affected by these, and overall upstream does not consider the issue
very important, but as GitHub advisories are rolled out for it, silecing
all the security warnings in this convoluted transitive dependency mess
gets cumbersome quickly.

Luckily, chrono is only used by wmi-rs on Windows platforms. The rest of
the ecosystem has been moving away from it, and wmi-rs now has a feature
flag to directly use the time crate instead. Let's enable it to pull
less transitive dependencies and properly fix all these warnings.
  • Loading branch information
AlexTMjugador committed Jun 17, 2022
1 parent cb80c97 commit 25e5153
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 45 deletions.
47 changes: 12 additions & 35 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 0 additions & 9 deletions deny.toml
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,6 @@ unmaintained = "warn"
yanked = "deny"
notice = "warn"
ignore = [
# This old version of time pulled by chrono might dereference a null
# pointer in Unix platforms. But this is not a concern at build time,
# and Windows builds (which actually use this library at runtime) are
# not affected
"RUSTSEC-2020-0071",
# Criterion depends on serde_cbor, which is unmaintained and has some quirks, but works:
# https://github.com/pyfisch/cbor/issues/179
"RUSTSEC-2021-0127"
Expand Down Expand Up @@ -99,10 +94,6 @@ multiple-versions = "warn"
# dependencies. It's best to have a warning than skipping crates here
wildcards = "warn"
highlight = "all"
skip = [
# chrono depends on this old version of the time crate
{ name = "time", version = "=0.1.44" }
]
skip-tree = [
# An ancient nom is pulled by the development dependency for
# benchmarking perfcnt. Let's ignore that for now. It doesn't
Expand Down
2 changes: 1 addition & 1 deletion packages/packsquash/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ regex = "1.5.6"

[target.'cfg(windows)'.dependencies]
winreg = "0.10.1"
wmi = "0.9.3"
wmi = { version = "0.9.3", default-features = false, features = ["time"] }

[target.'cfg(target_os = "macos")'.dependencies]
core-foundation = "0.9.3"
Expand Down

1 comment on commit 25e5153

@github-actions
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PackSquash library quick benchmarks

Benchmark suite Current: 25e5153 Previous: cb80c97 Ratio
tiny_benches_wall_time/empty_pack 11062780 ns/iter (± 614810) 14101526 ns/iter (± 729030) 0.78
small_benches_wall_time/aylas_khron_micro_pack 718878236 ns/iter (± 8208731) 762389944 ns/iter (± 7702052) 0.94
small_benches_wall_time/jilchu_chronos_micro_pack 13454882747 ns/iter (± 32847793) 15590937195 ns/iter (± 34272988) 0.86
small_benches_wall_time/aiamded_breadstick_micro_pack 2206662268 ns/iter (± 28992872) 2284793740 ns/iter (± 59136438) 0.97

This comment was automatically generated by workflow using github-action-benchmark.

Please sign in to comment.