Update time dependency in order to mitigate CVE-2020-26235
#632
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit bumps the version of `time` depended on to 0.2.23 in order to mitigate CVE-2020-26235.
This commit adds the relevant entry to the CHANGELOG.
|
I'm working on a PR for this right now purely to combine the best of both PRs: the end aim is just to fix the vulnerability without removing functionality. |
|
@jmcph4, @Milo123459 - Thanks for looking into this! Do you have a feel for when one of these fixes might land? This security PR has been open for one month now which seems like a long time. Since |
bors bot
added a commit
to meilisearch/milli
that referenced
this pull request
Feb 15, 2022
450: Get rid of chrono in favor of time r=Kerollmops a=irevoire We only use `chrono` as a wrapper around `time`, and since there has been an [open CVE on `chrono` for at least 3 months now](chronotope/chrono#632) and the repo seems to be [struggling with maintenance](chronotope/chrono#639), I think we should use `time` directly which is way more active and sufficient for our use case. EDIT: Actually the CVE status has been known for more than 6 months: chronotope/chrono#602 Co-authored-by: Irevoire <tamo@meilisearch.com>
|
This is being worked on in #639. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #629.
Thanks for contributing to chrono!
about adding the PR number)
If this pull request fixes a bug, does it add a test that verifies thatwe can't reintroduce it?