Skip to content
Unverified Commit f0b7f55b authored by ysaito1001's avatar ysaito1001 Committed by GitHub
Browse files

Fix cargo audit issue on chrono (#1907)

* Avoid the chrono crate depending on the time crate

This commit is in response to RUSTSEC-2020-0071 where there is a
potential segfault in the time crate. The aws-smithy-types-convert
crate now disables the default features of the chrono crate so that
it will not depend on the time crate.

* Depend on lambda_http without RUSTSEC-2020-0071

This commit updates the version of lambda_http used by aws-smithy-http-server
and aws-smithy-http-server-python to 0.7.0. The prior version 0.6.0 of
lambda_http used the chrono crate in a way that exposed a security issue
described in RUSTSEC-2020-0071. By switching to 0.7.0 of lambda_http, those
two crates do not exhibit vulnerabilities as reported by cargo audit.

* Bump minor version of lambda_http in pokemon-service

This commit updates the version of `lambda_http` used by `pokemon-service`
from 0.6.0 to 0.7.0. This is in sync with the fact that both
`aws-smithy-http-server` and `aws-smithy-http-server-python` now depend
on 0.7.0 of `lambda_http`. Failing to do so would cause `pokemon-service`
to fail to compile due to an error at `lambda_http::run(handler)` in the
main function of the `pokemon-service-lambda` binary:
the trait `Service<lambda_http::http::Request<lambda_http::Body>>` is not
implemented for `LambdaHandler<aws_smithy_http_server::routing::Router>`

* Depend on lambda-http 0.7.1

This commit updates the version of `lambda_http` from 0.7.0 to 0.7.1 in
the crates within the top-level `rust-runtime` workspace. These updates
are needed to solve the issue described in awslabs/aws-lambda-rust-runtime#556

* Update CHANGELOG.next.toml

* Address https://github.com/awslabs/smithy-rs/pull/1907\#pullrequestreview-1161609833



Co-authored-by: default avatarSaito <awsaito@c889f3b5ddc4.ant.amazon.com>
Co-authored-by: default avatarZelda Hessler <zhessler@amazon.com>
parent 2aafd044
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment