-
Type: Task
-
Resolution: Fixed
-
Priority: Unknown
-
Affects Version/s: None
-
Component/s: None
Some-Dood has created PR #722: Deps: bump various dependencies in mongo-rust-driver
Issue Text:
Hello there! I noticed that one of my projects had multiple duplicate dependencies due to `mongodb`. This PR bumps up the crate versions. Most of the bumps were patch-level. The notable bumps are noted below:
Crate | Old | New | Notes
----- | — | — | -----
`rustls-pemfile` | `0.3` | `1.0` | The [changelog](https://github.com/rustls/pemfile#release-history) declares no API changes. This is a safe major version bump.
`pbkdf2` | `0.10` | `0.11` | [Now uses `2021` version with MSRV `1.57`.](https://github.com/RustCrypto/password-hashes/blob/master/pbkdf2/CHANGELOG.md#0110-2022-03-28)
Sadly, the `time` crate appears to be an unremovable duplicate crate (for now) since `chrono` requires the `time` crate at version `0.1` while `bson` requires it at version `0.3`. The current maintainers did mention that the `time` dependency will be dropped ["in the next semver-compatible release"](https://github.com/chronotope/chrono/issues/602#issuecomment-1075915577). Let's make sure to upgrade to it so we can finally put the [CVE-2020-26235](https://nvd.nist.gov/vuln/detail/CVE-2020-26235) warnings to rest. π
There is one issue with the `pbkdf2` upgrade, though. I realized in hindsight that `mongodb` officially supports an MSRV of `1.56`, not `1.57`βjust one minor release behind! With that said, I would like to propose bumping up the MSRV (by one version) in the next release.
If this is not possible yet, I wouldn't mind removing the `pbkdf2` upgrade for now. It would be great to resolve this as early as possible, though, so that there would be less dependency duplication.
Thanks! π