Skip to content

Unmaintained advisory for humantime #2249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 10, 2025
Merged

Unmaintained advisory for humantime #2249

merged 1 commit into from
Mar 10, 2025

Conversation

oherrala
Copy link
Contributor

@oherrala oherrala commented Mar 8, 2025 •
edited
Loading

Last crates.io release 2021-01-13 and no GitHub commits since 2021-12-28.

Question about maintenance status posted 2022-08-04 with no answer from maintainer: chronotope/humantime#31

This crate has some big dependents like clap (with 20309 dependents) and env_logger (with 8090 dependents).

Update 2025-03-10: env_logger 0.11.7 dropped humantime dependency in favor of jiff.

@oherrala oherrala mentioned this pull request Mar 8, 2025
Closed
@tarcieri
Copy link
Member

tarcieri commented Mar 8, 2025

This one seems tricky due to the large numbers of downstream dependencies (I see cargo is also among them). It would be very noisy to publish an advisory.

For starters, it would probably be good to open an issue on env_logger at least and see if they're willing to transition to something else.

@oherrala oherrala mentioned this pull request Mar 8, 2025
Closed
@oherrala
Copy link
Contributor Author

oherrala commented Mar 8, 2025

@tarcieri Agreed.

I made a simple PR to env_logger for testing it with cyborgtime: rust-cli/env_logger#351

@oherrala
Copy link
Contributor Author

oherrala commented Mar 8, 2025

Another alternative to cyborgtime is jiff:

https://docs.rs/jiff/latest/jiff/fmt/friendly/index.html#comparison-with-the-humantime-crate

Ref. clap-rs/clap#5943 (comment)

This was referenced Mar 8, 2025
Merged
Merged
@oherrala
Copy link
Contributor Author

env_logger just released 0.11.7 that dropped humantime in favor of jiff: https://github.com/rust-cli/env_logger/releases/tag/v0.11.7

@tarcieri
Copy link
Member

It would be good to wait for a clap release before merging, IMO

This is another big user of humantime whose usages also seem pretty trivial and easy to switch to jiff: https://github.com/apache/arrow-rs

@oherrala oherrala mentioned this pull request Mar 10, 2025
Closed
@oherrala
Copy link
Contributor Author

@tarcieri I just opened PR to fix object_store: apache/arrow-rs#7261

@oherrala
Copy link
Contributor Author

Analysis of some more humantime dependants sorted by most crates.io downloads:

  • humantime-serde whole crate can be replaced by jiff
  • fern only using as dev dependency
  • sval only using as dev dependency
  • console-subscriber looks like easy to fix with jiff
  • prodash opt-in feature, not enabled by default
  • log4rs looks like easy to fix with jiff
  • cucumber looks like easy to fix with jiff
  • cargo looks like easy to fix with jiff

@tarcieri
Copy link
Member

cargo definitely seems concerning

@oherrala oherrala mentioned this pull request Mar 10, 2025
Merged
@oherrala
Copy link
Contributor Author

PR about switching cargo to jiff: rust-lang/cargo#15290

github-merge-queue bot pushed a commit to rust-lang/cargo that referenced this pull request Mar 10, 2025
@epage
Replace unmaintained humantime crate with jiff (#15290)
35cf085 
<!--
Thanks for submitting a pull request 🎉! Here are some tips for you:

* If this is your first contribution, read "Cargo Contribution Guide"
first:
  https://doc.crates.io/contrib/
* Run `cargo fmt --all` to format your code changes.
* Small commits and pull requests are always preferable and easy to
review.
* If your idea is large and needs feedback from the community, read how:
  https://doc.crates.io/contrib/process/#working-on-large-features
* Cargo takes care of compatibility. Read our design principles:
  https://doc.crates.io/contrib/design.html
* When changing help text of cargo commands, follow the steps to
generate docs:

https://github.com/rust-lang/cargo/tree/master/src/doc#building-the-man-pages
* If your PR is not finished, set it as "draft" PR or add "WIP" in its
title.
* It's ok to use the CI resources to test your PR, but please don't
abuse them.

### What does this PR try to resolve?

Explain the motivation behind this change.
A clear overview along with an in-depth explanation are helpful.

You can use `Fixes #<issue number>` to associate this PR to an existing
issue.

### How should we test and review this PR?

Demonstrate how you test this change and guide reviewers through your
PR.
With a smooth review process, a pull request usually gets reviewed
quicker.

If you don't know how to write and run your tests, please read the
guide:
https://doc.crates.io/contrib/tests

### Additional information

Other information you want to mention in this PR, such as prior arts,
future extensions, an unresolved problem, or a TODO list.
-->

The crate [`humantime`](https://crates.io/crates/humantime) appears to
be unmaintained. There's open PR in RustSec's advisory-db about this:
rustsec/advisory-db#2249

The crates [`clap`](https://crates.io/crates/clap) and
[`env_logger`](https://crates.io/crates/env_logger) have already made
the switch from `humantime` to [`jiff`](https://crates.io/crates/jiff):

 * clap-rs/clap#5944
 * rust-cli/env_logger#352

The `jiff` crate is already dependency on `cargo` via `gix` (albeit old
0.1 version, but that's probably fixed in [next gix
release](GitoxideLabs/gitoxide@3ae99a4)):

```
jiff v0.1.29
└── gix-date v0.9.3
    ├── gix v0.70.0
    │   └── cargo v0.88.0 (/Users/oherrala/rust/cargo)
```

This PR shouldn't have any functional change to cargo itself.
@oherrala
Copy link
Contributor Author

@tarcieri cargo merged change to replace humantime with jiff: rust-lang/cargo#15290

@tarcieri
Copy link
Member

tarcieri commented Mar 10, 2025 •
edited
Loading

Cool. I'd say just wait for a clap release with the migration to jiff and we can merge this advisory.

Edit: oh hey, I guess clap v4.5.32 is out with the change. Let me give it one lass pass.

@tarcieri tarcieri merged commit 23853f2 into rustsec:main Mar 10, 2025
1 check passed
@oherrala oherrala deleted the humantime branch March 10, 2025 22:01
This was referenced Mar 11, 2025
Merged
Closed
cratelyn added a commit to linkerd/linkerd2-proxy that referenced this pull request Mar 12, 2025
@cratelyn
chore(deps): address RUSTSEC-2025-0014
d149cf1 
this commit replaces `humantime`, which is no longer maintained, with
`jiff`.

see this error when `main` today is built:

```
error[unmaintained]: humantime is unmaintained
   ┌─ /linkerd/linkerd2-proxy/Cargo.lock:78:1
   │
78 │ humantime 2.1.0 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0014
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0014
   ├ Latest `humantime` crates.io release is four years old and GitHub repository has
     not seen commits in four years. Question about maintenance status has not gotten
     any reaction from maintainer: chronotope/humantime#31

     ## Possible alternatives

      * [jiff](https://crates.io/crates/jiff) provides same kind of functionality
   ├ Announcement: chronotope/humantime#31
   ├ Solution: No safe upgrade is available!
   ├ humantime v2.1.0
     └── linkerd-http-access-log v0.1.0
         └── linkerd-app-inbound v0.1.0
             ├── linkerd-app v0.1.0
             │   ├── linkerd-app-integration v0.1.0
             │   └── linkerd2-proxy v0.1.0
             ├── linkerd-app-admin v0.1.0
             │   ├── linkerd-app v0.1.0 (*)
             │   └── (dev) linkerd-app-integration v0.1.0 (*)
             └── linkerd-app-gateway v0.1.0
                 └── linkerd-app v0.1.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok
```

see:
  * rustsec/advisory-db#2249.
  * chronotope/humantime#31.

Signed-off-by: katelyn martin <kate@buoyant.io>
@cratelyn cratelyn mentioned this pull request Mar 12, 2025
Merged
cratelyn added a commit to linkerd/linkerd2-proxy that referenced this pull request Mar 12, 2025
@cratelyn
chore(deps): address RUSTSEC-2025-0014
2533f7d 
this commit replaces `humantime`, which is no longer maintained, with
`jiff`.

see this error when `main` today is built:

```
error[unmaintained]: humantime is unmaintained
   ┌─ /linkerd/linkerd2-proxy/Cargo.lock:78:1
   │
78 │ humantime 2.1.0 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0014
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0014
   ├ Latest `humantime` crates.io release is four years old and GitHub repository has
     not seen commits in four years. Question about maintenance status has not gotten
     any reaction from maintainer: chronotope/humantime#31

     ## Possible alternatives

      * [jiff](https://crates.io/crates/jiff) provides same kind of functionality
   ├ Announcement: chronotope/humantime#31
   ├ Solution: No safe upgrade is available!
   ├ humantime v2.1.0
     └── linkerd-http-access-log v0.1.0
         └── linkerd-app-inbound v0.1.0
             ├── linkerd-app v0.1.0
             │   ├── linkerd-app-integration v0.1.0
             │   └── linkerd2-proxy v0.1.0
             ├── linkerd-app-admin v0.1.0
             │   ├── linkerd-app v0.1.0 (*)
             │   └── (dev) linkerd-app-integration v0.1.0 (*)
             └── linkerd-app-gateway v0.1.0
                 └── linkerd-app v0.1.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok
```

see:
  * rustsec/advisory-db#2249.
  * chronotope/humantime#31.

Signed-off-by: katelyn martin <kate@buoyant.io>
cratelyn added a commit to linkerd/linkerd2-proxy that referenced this pull request Mar 12, 2025
@cratelyn
chore(deps): address RUSTSEC-2025-0014
f6fd400 
this commit replaces `humantime`, which is no longer maintained, with
`jiff`.

see this error when `main` today is built:

```
error[unmaintained]: humantime is unmaintained
   ┌─ /linkerd/linkerd2-proxy/Cargo.lock:78:1
   │
78 │ humantime 2.1.0 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0014
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0014
   ├ Latest `humantime` crates.io release is four years old and GitHub repository has
     not seen commits in four years. Question about maintenance status has not gotten
     any reaction from maintainer: chronotope/humantime#31

     ## Possible alternatives

      * [jiff](https://crates.io/crates/jiff) provides same kind of functionality
   ├ Announcement: chronotope/humantime#31
   ├ Solution: No safe upgrade is available!
   ├ humantime v2.1.0
     └── linkerd-http-access-log v0.1.0
         └── linkerd-app-inbound v0.1.0
             ├── linkerd-app v0.1.0
             │   ├── linkerd-app-integration v0.1.0
             │   └── linkerd2-proxy v0.1.0
             ├── linkerd-app-admin v0.1.0
             │   ├── linkerd-app v0.1.0 (*)
             │   └── (dev) linkerd-app-integration v0.1.0 (*)
             └── linkerd-app-gateway v0.1.0
                 └── linkerd-app v0.1.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok
```

see:
  * rustsec/advisory-db#2249.
  * chronotope/humantime#31.

Signed-off-by: katelyn martin <kate@buoyant.io>
cratelyn added a commit to linkerd/linkerd2-proxy that referenced this pull request Mar 12, 2025
@cratelyn
chore(deps): address RUSTSEC-2025-0014
c2e4966 
this commit replaces `humantime`, which is no longer maintained, with
`jiff`.

see this error when `main` today is built:

```
error[unmaintained]: humantime is unmaintained
   ┌─ /linkerd/linkerd2-proxy/Cargo.lock:78:1
   │
78 │ humantime 2.1.0 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0014
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0014
   ├ Latest `humantime` crates.io release is four years old and GitHub repository has
     not seen commits in four years. Question about maintenance status has not gotten
     any reaction from maintainer: chronotope/humantime#31

     ## Possible alternatives

      * [jiff](https://crates.io/crates/jiff) provides same kind of functionality
   ├ Announcement: chronotope/humantime#31
   ├ Solution: No safe upgrade is available!
   ├ humantime v2.1.0
     └── linkerd-http-access-log v0.1.0
         └── linkerd-app-inbound v0.1.0
             ├── linkerd-app v0.1.0
             │   ├── linkerd-app-integration v0.1.0
             │   └── linkerd2-proxy v0.1.0
             ├── linkerd-app-admin v0.1.0
             │   ├── linkerd-app v0.1.0 (*)
             │   └── (dev) linkerd-app-integration v0.1.0 (*)
             └── linkerd-app-gateway v0.1.0
                 └── linkerd-app v0.1.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok
```

see:
  * rustsec/advisory-db#2249.
  * chronotope/humantime#31.

Signed-off-by: katelyn martin <kate@buoyant.io>
cratelyn added a commit to linkerd/linkerd2-proxy that referenced this pull request Mar 12, 2025
@cratelyn
chore(deps): address RUSTSEC-2025-0014 (#3750)
c35cf27 
this commit replaces `humantime`, which is no longer maintained, with
`jiff`.

see this error when `main` today is built:

```
error[unmaintained]: humantime is unmaintained
   ┌─ /linkerd/linkerd2-proxy/Cargo.lock:78:1
   │
78 │ humantime 2.1.0 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0014
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0014
   ├ Latest `humantime` crates.io release is four years old and GitHub repository has
     not seen commits in four years. Question about maintenance status has not gotten
     any reaction from maintainer: chronotope/humantime#31

     ## Possible alternatives

      * [jiff](https://crates.io/crates/jiff) provides same kind of functionality
   ├ Announcement: chronotope/humantime#31
   ├ Solution: No safe upgrade is available!
   ├ humantime v2.1.0
     └── linkerd-http-access-log v0.1.0
         └── linkerd-app-inbound v0.1.0
             ├── linkerd-app v0.1.0
             │   ├── linkerd-app-integration v0.1.0
             │   └── linkerd2-proxy v0.1.0
             ├── linkerd-app-admin v0.1.0
             │   ├── linkerd-app v0.1.0 (*)
             │   └── (dev) linkerd-app-integration v0.1.0 (*)
             └── linkerd-app-gateway v0.1.0
                 └── linkerd-app v0.1.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok
```

see:
  * rustsec/advisory-db#2249.
  * chronotope/humantime#31.

Signed-off-by: katelyn martin <kate@buoyant.io>
EliahKagan added a commit to EliahKagan/gitoxide that referenced this pull request Mar 18, 2025
@EliahKagan
Delist withdrawn RUSTSEC-2025-0014
9378851 
The `huamntime` crate briefly had unmaintained status, for which
RUSTSEC-2025-0014. It has since become maintained again, and that
advisory has been withdrawn, so this removes it from the list of
advisores we allow `cargo deny` to ignore.

Background:

- https://rustsec.org/advisories/RUSTSEC-2025-0014.html (advisory)
- rustsec/advisory-db#2249 (issued)
- rustsec/advisory-db#2252 (withdrawn)
- cf7f34d in GitoxideLabs#1882 (commit that ignored it, among other changes)
@EliahKagan EliahKagan mentioned this pull request Mar 18, 2025
Merged
EliahKagan added a commit to EliahKagan/gitoxide that referenced this pull request Mar 18, 2025
@EliahKagan
Delist withdrawn RUSTSEC-2025-0014
56ecb63 
The `humantime` crate briefly had unmaintained status, for which
RUSTSEC-2025-0014 was issued. It has since become maintained again,
and that advisory has been withdrawn. So this removes it from the
list of advisores we allow `cargo deny` to ignore.

Background:

- https://rustsec.org/advisories/RUSTSEC-2025-0014.html (advisory)
- rustsec/advisory-db#2249 (issued)
- rustsec/advisory-db#2252 (withdrawn)
- cf7f34d in GitoxideLabs#1882 (commit that ignored it, among other changes)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tarcieri tarcieri tarcieri approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@oherrala @tarcieri