switch from chrono to time
Roguelazer opened this issue · 2 comments
It seems like chrono isn't going to be maintained any more and, in particular, is not going to have RUSTSEC-2020-0159 / RUSTSEC-2020-0071 fixed. I believe most folks are moving from chrono to time 0.3.
Note that time does not support strftime-style formatting language and instead has their own bespoke formatting language (see time-rs/time#341).
Not sure if the time feature is used via chrono at all by fern.
If not, then adding default-features = false, features ["clock"] to chrono would solve that dependency.
That would at least solve the RUSTSEC-2020-0071 one.
Also, it looks like there is some activity at chrono the past few days/weeks also to try and fix the other CVE.
fern only uses chrono for examples, and doesn't recommend using any functions in chrono which depend on time, so I'm not too worried about this.
With that said, #91 changed the default features as you suggested BlackDex, so I believe this is resolved.
We could move back to time for examples, but given that it doesn't support strftime so we'd have to rebuild examples, and chrono seems to still be supported, it doesn't seem worth it to me.