Merge pull request #1610 from volta-cli/zip-sans-time

Configure `zip` not to use its `time` feature
volta-cli · Dec 20, 2023 · bf97e8c · bf97e8c
2 parents f594000 + 59e272a
commit bf97e8c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 13 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/archive/Cargo.toml b/crates/archive/Cargo.toml
@@ -7,7 +7,10 @@ edition = "2018"
 [dependencies]
 flate2 = "1.0"
 tar = "0.4.13"
-zip_rs = { version = "0.5", package = "zip" }
+# Set features manually to drop usage of `time` crate: we do not rely on that
+# set of capabilities, and it has a vulnerability. NOTE: this should be updated
+# to include the `aes-crypto` and `zstd` features when upgrading to v0.6+.
+zip_rs = { version = "0.5", package = "zip", default-features = false, features = ["deflate", "bzip2"] }
 tee = "0.1.0"
 fs-utils = { path = "../fs-utils" }
 progress-read = { path = "../progress-read" }