rust/cargo: ignore RUSTSEC-2026-0009 for time crate#14767
rust/cargo: ignore RUSTSEC-2026-0009 for time crate#14767
Conversation
cargo audit reports this security issue with the time crate but Suricata remains unaffected as no influenced fn is used by Suricata. Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009 The MSRV for newer time crate versions are higher than the MSRV for Suricata right now: 1.75.0 Hence, the best course of action is to suppress this warning. Ticket: 8269
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #14767 +/- ##
=======================================
Coverage 82.15% 82.15%
=======================================
Files 1003 1003
Lines 263674 263674
=======================================
+ Hits 216611 216612 +1
+ Misses 47063 47062 -1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Information: QA skipped due to no C or rust code changed detected. Set to force a run. Pipeline = code |
|
The function(s) aren't used by Suricata directly, but what about indirectly? Is the crate an indirect dependency where other crates may be using the affected functionality anyway? |
|
No rfc 2822 parsing appears to happen in the dependency chain. x509 does format as rfc 2822, but this issue is with respect to parsing. |
Is there a way w/o manually reviewing to find out if future changes in our code or in our dependencies would use the affected functions? |
AFAIK, only if we build something to do that. Other option is to fork and patch so we can keep our MSRV requirements. |
4 participants
Previous PR: #14763
Changes since v2:
Link to ticket: https://redmine.openinfosecfoundation.org/issues/8269