Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update high-confidence-rust-patch #8

Merged
merged 1 commit into from
May 1, 2024
Merged

fix(deps): update high-confidence-rust-patch #8

merged 1 commit into from
May 1, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented May 1, 2024

Mend Renovate

This PR contains the following updates:

Package Type Update Change
chrono dependencies patch 0.4 -> 0.4.38
dtoa dependencies patch 1 -> 1.0.9
test-generator (source) dev-dependencies patch 0.3 -> 0.3.1

Release Notes

chronotope/chrono (chrono)

v0.4.38

Compare Source

This release bring a ca. 20% improvement to the performance of the formatting code, and a convenient days_since method for the Weekday type.

Chrono 0.4.38 also removes the long deprecated rustc-serialize feature. Support for rustc-serialize will be soft-destabilized in the next Rust edition. Removing the feature will not break existing users of the feature; Cargo will just not update dependents that rely on it to newer versions of chrono.

In chrono 0.4.36 we made an accidental breaking change by switching to derive(Copy) for DateTime instead of a manual implementation. It is reverted in this release.

Removals

Additions

Fixes

  • Return error when rounding with a zero duration (#​1474, thanks @​Dav1dde)
  • Manually implement Copy for DateTime if offset is Copy (#​1573)

Internal

  • Inline test_encodable_json and test_decodable_json functions (#​1550)
  • CI: Reduce combinations in cargo hack check (#​1553)
  • Refactor formatting code (#​1335)
  • Optimize number formatting (#​1558)
  • Only package files needed for building and testing (#​1554)

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.37

Compare Source

Version 0.4.36 introduced an unexpected breaking change and was yanked. In it LocalResult was renamed to MappedLocalTime to avoid the impression that it is a Result type were some of the results are errors. For backwards compatibility a type alias with the old name was added.

As it turns out there is one case where a type alias behaves differently from the regular enum: you can't import enum variants from a type alias with use chrono::LocalResult::*. With 0.4.37 we make the new name MappedLocalTime the alias, but keep using it in function signatures and the documentation as much as possible.

See also the release notes of chrono 0.4.36 from yesterday for the yanked release.

v0.4.36

Compare Source

This release un-deprecates the methods on TimeDelta that were deprecated with the 0.4.35 release because of the churn they are causing for the ecosystem.

New is the DateTime::with_time() method. As an example of when it is useful:

use chrono::{Local, NaiveTime};
// Today at 12:00:00
let today_noon = Local::now().with_time(NaiveTime::from_hms_opt(12, 0, 0).unwrap());

Additions

Deprecations

  • Revert TimeDelta deprecations (#​1543)
  • Deprecate TimeStamp::timestamp_subsec_nanos, which was missed in the 0.4.35 release (#​1486)

Documentation

  • Correct version number of deprecation notices (#​1486)
  • Fix some typos (#​1505)
  • Slightly improve serde documentation (#​1519)
  • Main documentation: simplify links and reflow text (#​1535)

Internal

  • CI: Lint benchmarks (#​1489)
  • Remove unnessary Copy and Send impls (#​1492, thanks @​erickt)
  • Backport streamlined NaiveDate unit tests (#​1500, thanks @​Zomtir)
  • Rename LocalResult to TzResolution, add alias (#​1501)
  • Update windows-bindgen to 0.55 (#​1504)
  • Avoid duplicate imports, which generate warnings on nightly (#​1507)
  • Add extra debug assertions to NaiveDate::from_yof (#​1518)
  • Some small simplifications to DateTime::date_naive and NaiveDate::diff_months (#​1530)
  • Remove unwrap in Unix Local type (#​1533)
  • Use different method to ignore feature-dependent doctests (#​1534)

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.35

Compare Source

Most of our efforts have shifted to improving the API for a 0.5 release, for which cleanups and refactorings are landing on the 0.4.x branch.

The most significant changes in this release are two sets of deprecations.

  • We deprecated all timestamp-related methods on NaiveDateTime. The reason is that a timestamp is defined to be in UTC. The NaiveDateTime type doesn't know the offset from UTC, so it was technically wrong to have these methods. The alternative is to use the similar methods on the DateTime<Utc> type, or from the TimeZone trait.

    Converting from NaiveDateTime to DateTime<Utc> is simple with .and_utc(), and in the other direction with .naive_utc().

  • The panicking constructors of TimeDelta (the new name of the Duration type) are deprecated. This was the last part of chrono that defaulted to panicking on error, dating from before rust 1.0.

  • A nice change is that NaiveDate now includes a niche. So now Option<NaiveDate>, Option<NaiveDateTime> and Option<DateTime<Tz>> are the same size as their base types.

  • format::Numeric and format::Fixed are marked as non_exhaustive. This will allow us to improve our formatting and parsing support, and we have reason to believe this breaking change will have little to no impact on users.

Additions

  • Add DateTime::{from_timestamp_micros, from_timestamp_nanos} (#​1234)
  • Add getters to Parsed (#​1465)

Deprecations

  • Deprecate timestamp methods on NaiveDateTime (#​1473)
  • Deprecate panicking constructors of TimeDelta (#​1450)

Changes/fixes

  • Use NonZeroI32 inside NaiveDate (#​1207)
  • Mark format::Numeric and format::Fixed as non_exhaustive (#​1430)
  • Parsed fixes to error values (#​1439)
  • Use overflowing_naive_local in DateTime::checked_add* (#​1333)
  • Do complete range checks in Parsed::set_* (#​1465)

Documentation

Internal

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.34

Compare Source

Notable changes

  • In chrono 0.4.34 we finished the work to make all methods const where doing so is supported by rust 1.61.
  • We renamed the Duration type to TimeDelta. This removes the confusion between chrono's type and the later Duration type in the standard library. It will remain available under the old name as a type alias for compatibility.
  • The Windows implementation of Local is rewritten. The new version avoids panics when the date is outside of the range supported by windows (the years 1601 to 30828), and gives more accurate results during DST transitions.
  • The Display format of TimeDelta is modified to conform better to ISO 8601. Previously it converted all values greater than 24 hours to a value with days. This is not correct, as doing so changes the duration from an 'accurate' to a 'nominal' representation to use ISO 8601 terms.

Fixes

Additions

Changes

  • Rename Duration to TimeDelta, add type alias (#​1406)
  • Make TimeDelta methods const (#​1337)
  • Make remaining methods of NaiveDate, NaiveWeek, NaiveTime and NaiveDateTime const where possible (#​1337)
  • Make methods on DateTime const where possible (#​1400)
  • Make Display format of TimeDelta conform better to ISO 8601 (#​1328)

Documentation

Internal

  • Switch branch names: 0.4.x releases are the main branch, work on 0.5 happens in the 0.5.x branch (#​1390, #​1402).
  • Don't use deprecated method in impl Arbitrary for DateTime and set up CI test (#​1336)
  • Remove workaround for Rust < 1.61 (#​1393)
  • Bump codecov/codecov-action from 3 to 4 (#​1404)
  • Remove partial support for handling -0000 offset (#​1411)
  • Move TOO_LONG error out of parse_internal (#​1419)

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.33

Compare Source

This release fixes the broken docrs.rs build of chrono 0.4.32.

What's Changed

v0.4.32

Compare Source

In this release we shipped part of the effort to reduce the number of methods that could unexpectedly panic, notably for the DateTime and Duration types.

Chrono internally stores the value of a DateTime in UTC, and transparently converts it to the local value as required. For example adding a second to a DateTime needs to be done in UTC to get the correct result, but adding a day needs to be done in local time to be correct. What happens when the value is near the edge of the representable range, and the implicit conversions pushes it beyond the representable range? Many methods could panic on such inputs, including formatting the value for Debug output.

In chrono 0.4.32 the range of NaiveDate, NaiveDateTime and DateTime is made slightly smaller. This allows us to always do the implicit conversion, and in many cases return the expected result. Specifically the range is now from January 1, -262144 until December 31, 262143, one year less on both sides than before. We expect this may trip up tests if you hardcoded the MIN and MAX dates.

Duration had a similar issue. The range of this type was pretty arbitrary picked to match the range of an i64 in milliseconds. Negating an i64::MIN pushes a value out of range, and in the same way negating Duration::MIN could push it out of our defined range and cause a panic. This turns out to be somewhat common and hidden behind many layers of abstraction. We adjusted the type to have a minimum value of -Duration::MAX instead and prevent the panic case.

Other highlights:

  • Duration gained new fallible initialization methods.
  • Better support for rkyv.
  • Most methods on NaiveDateTime are now const.
  • We had to bump our MSRV to 1.61 to keep building with our dependencies. This will also allow us to make more methods on DateTime const in a future release.

Complete list of changes:

Fixes

  • Fix panic in TimeZone::from_local_datetime (#​1071)
  • Fix out of range panics in DateTime getters and setters (#​1317, #​1329)

Additions

Changes

  • Fix panic in Duration::MIN.abs() (adjust Duration::MIN by 1 millisecond) (#​1334)
  • Bump MSRV to 1.61 (#​1347)
  • Update windows-targets requirement from 0.48 to 0.52 (#​1360)
  • Update windows-bindgen to 0.52 (#​1379)

Deprecations

  • Deprecate standalone format functions (#​1306)

Documentation

Rkyv support

Changes to unstable features

  • Don't let unstable-locales imply the alloc feature (#​1307)
  • Remove format::{format_localized, format_item_localized} (#​1311)
  • Inline write_rfc2822_inner, don't localize (#​1322)

Internal

  • Add benchmark for DateTime::with_* (#​1309)
  • Fix *_DAYS_FROM_YEAR_0 calculation (#​1312)
  • Add NaiveTime::overflowing_(add|sub)_offset (#​1310)
  • Rewrite DateTime::overflowing_(add|sub)_offset (#​1069)
  • Tests calling date command set env LC_ALL (#​1315, thanks @​jtmoon79)
  • Update deny.toml (#​1320)
  • Bump actions/setup-node from 3 to 4 (#​1346)
  • test.yml remove errant with: node-version (#​1352, thanks @​jtmoon79)
  • CI Linting: Fix missing sources checkout in toml job (#​1371, thanks @​gibbz00)
  • Silence clippy lint for test code with Rust 1.74.0 (#​1362)

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.31

Compare Source

Another maintenance release.
It was not a planned effort to improve our support for UNIX timestamps, yet most PRs seem related to this.

Deprecations
  • Deprecate timestamp_nanos in favor of the non-panicking timestamp_nanos_opt (#​1275)
Additions
Fixes
  • Format day of month in RFC 2822 without padding (#​1272)
  • Don't allow strange leap seconds which are not on a minute boundary initialization methods (#​1283)
    This makes many methods a little more strict:
    • NaiveTime::from_hms_milli
    • NaiveTime::from_hms_milli_opt
    • NaiveTime::from_hms_micro
    • NaiveTime::from_hms_micro_opt
    • NaiveTime::from_hms_nano
    • NaiveTime::from_hms_nano_opt
    • NaiveTime::from_num_seconds_from_midnight
    • NaiveTime::from_num_seconds_from_midnight_opt
    • NaiveDate::and_hms_milli
    • NaiveDate::and_hms_milli_opt
    • NaiveDate::and_hms_micro
    • NaiveDate::and_hms_micro_opt
    • NaiveDate::and_hms_nano
    • NaiveDate::and_hms_nano_opt
    • NaiveDateTime::from_timestamp
    • NaiveDateTime::from_timestamp_opt
    • TimeZone::timestamp
    • TimeZone::timestamp_opt
  • Fix underflow in NaiveDateTime::timestamp_nanos_opt (#​1294, thanks @​crepererum)
Documentation
  • Add more documentation about the RFC 2822 obsolete date format (#​1267)
Internal
  • Remove internal __doctest feature and doc_comment dependency (#​1276)
  • CI: Bump actions/checkout from 3 to 4 (#​1280)
  • Optimize NaiveDate::add_days for small values (#​1214)
  • Upgrade pure-rust-locales to 0.7.0 (#​1288, thanks @​jeremija wo did good improvements on pure-rust-locales)

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.30

Compare Source

In this release, we have decided to swap out the chrono::Duration type (which has been a re-export of time 0.1 Duration type) with our own definition, which exposes a strict superset of the time::Duration API. This helps avoid warnings about the CVE-2020-26235 and RUSTSEC-2020-0071 advisories for downstream users and allows us to improve the Duration API going forward.

While this is technically a SemVer-breaking change, we expect the risk of downstream users experiencing actual incompatibility to be exceedingly limited (see our analysis of public code using a crater-like experiment), and not enough justification for the large ecosystem churn of a 0.5 release. If you have any feedback on these changes, please let us know in #​1268.

Additions
Documentation

Relation between chrono and time 0.1

Rust first had a time module added to std in its 0.7 release. It later moved to libextra, and then to a libtime library shipped alongside the standard library. In 2014 work on chrono started in order to provide a full-featured date and time library in Rust. Some improvements from chrono made it into the standard library; notably, chrono::Duration was included as std::time::Duration (rust#15934) in 2014.

In preparation of Rust 1.0 at the end of 2014 libtime was moved out of the Rust distro and into the time crate to eventually be redesigned (rust#18832, rust#18858), like the num and rand crates. Of course chrono kept its dependency on this time crate. time started re-exporting std::time::Duration during this period. Later, the standard library was changed to have a more limited unsigned Duration type (rust#24920, RFC 1040), while the time crate kept the full functionality with time::Duration. time::Duration had been a part of chrono's public API.

By 2016 time 0.1 lived under the rust-lang-deprecated organisation and was not actively maintained (time#136). chrono absorbed the platform functionality and Duration type of the time crate in chrono#478 (the work started in chrono#286). In order to preserve compatibility with downstream crates depending on time and chrono sharing a Duration type, chrono kept depending on time 0.1. chrono offered the option to opt out of the time dependency by disabling the oldtime feature (swapping it out for an effectively similar chrono type). In 2019, @​jhpratt took over maintenance on the time crate and released what amounts to a new crate as time 0.2.

Security advisories

In November of 2020 CVE-2020-26235 and RUSTSEC-2020-0071 were opened against the time crate. @​quininer had found that calls to localtime_r may be unsound (chrono#499). Eventually, almost a year later, this was also made into a security advisory against chrono as RUSTSEC-2020-0159, which had platform code similar to time.

On Unix-like systems a process is given a timezone id or description via the TZ environment variable. We need this timezone data to calculate the current local time from a value that is in UTC, such as the time from the system clock. time 0.1 and chrono used the POSIX function localtime_r to do the conversion to local time, which reads the TZ variable.

Rust assumes the environment to be writable and uses locks to access it from multiple threads. Some other programming languages and libraries use similar locking strategies, but these are typically not shared across languages. More importantly, POSIX declares modifying the environment in a multi-threaded process as unsafe, and getenv in libc can't be changed to take a lock because it returns a pointer to the data (see rust#27970 for more discussion).

Since version 4.20 chrono no longer uses localtime_r, instead using Rust code to query the timezone (from the TZ variable or via iana-time-zone as a fallback) and work with data from the system timezone database directly. The code for this was forked from the tz-rs crate by @​x-hgg-x. As such, chrono now respects the Rust lock when reading the TZ environment variable. In general, code should avoid modifying the environment.

Removing time 0.1

Because time 0.1 has been unmaintained for years, however, the security advisory mentioned above has not been addressed. While chrono maintainers were careful not to break backwards compatibility with the time::Duration type, there has been a long stream of issues from users inquiring about the time 0.1 dependency with the vulnerability. We investigated the potential breakage of removing the time 0.1 dependency in chrono#1095 using a crater-like experiment and determined that the potential for breaking (public) dependencies is very low. We reached out to those few crates that did still depend on compatibility with time 0.1.

As such, for chrono 0.4.30 we have decided to swap out the time 0.1 Duration implementation for a local one that will offer a strict superset of the existing API going forward. This will prevent most downstream users from being affected by the security vulnerability in time 0.1 while minimizing the ecosystem impact of semver-incompatible version churn.

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.29

Compare Source

This release fixes a panic introduced in chrono 0.4.27 in FromStr<DateTime<Utc>> (#​1253).

Chrono now has a Discord channel.

Fixes

  • Fix arbitrary string slicing in parse_rfc3339_relaxed (#​1254)

Deprecations

  • Deprecate TimeZone::datetime_from_str (#​1251)

Documentation

Internal improvements

  • Revert "add test_issue_866" (#​1238)
  • CI: run tests on i686 and wasm32-wasi (#​1237)
  • CI: Include doctests for code coverage (#​1248)
  • Move benchmarks to a separate crate (#​1243)
    This allows us to upgrade the criterion dependency to 5.1 without changing our MSRV.
  • Add Discord link to README (#​1240, backported in #​1256)

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.28

Compare Source

This release fixes a test failure on 32-bit targets introduced with 0.4.27, see https://github.com/chronotope/chrono/issues/1234.

v0.4.27

Compare Source

This release bumps the MSRV from 1.56 to 1.57. This allows us to take advantage of the panicking in const feature. In this release most methods on NaiveDate and NaiveTime are made const, NaiveDateTime and others will follow in a later release.

The parser for the %+ formatting specifier and the RFC3339 formatting item is switched from a strict to a relaxed parser (see https://github.com/chronotope/chrono/pull/1145). This matches the existing documentation, and the parser used by DateTime::from_str. If you need to validate the input, consider using DateTime::from_rfc3339.

Deprecations

Additions

Fixes

Documentation

Internal improvements

Thanks to all contributors on behalf of the chrono team, @​djc and @​pitdicker!

v0.4.26

Compare Source

The changes from #​807 we merged for 0.4.25 unfortunately restricted parsing in a way that was incompatible with earlier 0.4.x releases. We reverted this in #​1113. A small amount of other changes were merged since.

Thanks on behalf of the chrono team (@​djc and @​esheppa) to all contributors!

v0.4.25

Compare Source

Time for another maintenance release. This release bumps the MSRV to 1.56; given MSRV bumps in chrono's dependencies (notably for syn 2), we felt that it no longer made sense to support any older versions. Feedback welcome in our issue tracker!

Additions

Fixes

Refactoring

Documentation

Internal improvements

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot enabled auto-merge (rebase) May 1, 2024 18:13
auto-merge was automatically disabled May 1, 2024 18:14

Base branch requires signed commits

@renovate renovate bot merged commit f661a64 into main May 1, 2024
5 checks passed
@renovate renovate bot deleted the renovate/high-confidence-rust-patch branch May 1, 2024 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@stedi-pr-bot stedi-pr-bot[bot] stedi-pr-bot[bot] approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants