Uploaded image for project: 'Rust Driver'
  1. Rust Driver
  2. RUST-1445

mongo-rust-driver - PR #722: Deps: bump various dependencies

    • Type: Icon: Task Task
    • Resolution: Fixed
    • Priority: Icon: Unknown Unknown
    • 2.4.0
    • Affects Version/s: None
    • Component/s: None

      Some-Dood has created PR #722: Deps: bump various dependencies in mongo-rust-driver

      Issue Text:
      Hello there! I noticed that one of my projects had multiple duplicate dependencies due to `mongodb`. This PR bumps up the crate versions. Most of the bumps were patch-level. The notable bumps are noted below:

      Crate | Old | New | Notes
      ----- | — | — | -----
      `rustls-pemfile` | `0.3` | `1.0` | The [changelog](https://github.com/rustls/pemfile#release-history) declares no API changes. This is a safe major version bump.
      `pbkdf2` | `0.10` | `0.11` | [Now uses `2021` version with MSRV `1.57`.](https://github.com/RustCrypto/password-hashes/blob/master/pbkdf2/CHANGELOG.md#0110-2022-03-28)

      Sadly, the `time` crate appears to be an unremovable duplicate crate (for now) since `chrono` requires the `time` crate at version `0.1` while `bson` requires it at version `0.3`. The current maintainers did mention that the `time` dependency will be dropped ["in the next semver-compatible release"](https://github.com/chronotope/chrono/issues/602#issuecomment-1075915577). Let's make sure to upgrade to it so we can finally put the [CVE-2020-26235](https://nvd.nist.gov/vuln/detail/CVE-2020-26235) warnings to rest. πŸ˜…

      There is one issue with the `pbkdf2` upgrade, though. I realized in hindsight that `mongodb` officially supports an MSRV of `1.56`, not `1.57`β€”just one minor release behind! With that said, I would like to propose bumping up the MSRV (by one version) in the next release.

      If this is not possible yet, I wouldn't mind removing the `pbkdf2` upgrade for now. It would be great to resolve this as early as possible, though, so that there would be less dependency duplication.

      Thanks! πŸŽ‰

            Assignee:
            abraham.egnor@mongodb.com Abraham Egnor
            Reporter:
            dbeng-pm-bot PM Bot
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: