Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

subscriber: replace chrono with time for timestamp formatting #1646

Merged
merged 4 commits into from
Oct 18, 2021
Merged

subscriber: replace chrono with time for timestamp formatting #1646

merged 4 commits into from
Oct 18, 2021

Conversation

hawkw
Copy link
Member

@hawkw hawkw commented Oct 18, 2021

Motivation

Currently, tracing-subscriber supports the chrono crate for
timestamp formatting, via a default-on feature flag. When this code was
initially added to tracing-subscriber, the time crate did not have
support for the timestamp formatting options we needed.

Unfortunately, the chrono crate's maintainance status is now in
question (see #1598). Furthermore, chrono depends on version 0.1 of
the time crate, which contains a security vulnerability
(https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
vulnerability is fixed in more recent releases of time, but chrono
still uses v0.1.

Solution

Fortunately, the time crate now has its own timestamp formatting
support.

This branch replaces the ChronoLocal and ChronoUtc timestamp
formatters with new LocalTime and UtcTime formatters. These
formatters use the time crate's formatting APIs rather than
chrono's. This removes the vulnerable dependency on time 0.1

Additionally, the new time APIs are feature flagged as an opt-in
feature, rather than as an opt-out feature. This should make it easier
to avoid accidentally depending on the time crate when more
sophisticated timestamp formatting is not required.

In a follow-up branch, we could also add support for humantime as an
option for timestamp formatting.

Naturally, since this removes existing APIs, this is a breaking change,
and will thus require publishing tracing-subscriber 0.3. We'll want to
do some other breaking changes as well.

Fixes #1598.

@hawkw
subscriber: replace chrono with time for timestamp formatting
0f38b92 
## Motivation

Currently, `tracing-subscriber` supports the `chrono` crate for
timestamp formatting, via a default-on feature flag. When this code was
initially added to `tracing-subscriber`, the `time` crate did not have
support for the timestamp formatting options we needed.

Unfortunately, the `chrono` crate's maintainance status is now in
question (see #1598). Furthermore, `chrono` depends on version 0.1 of
the `time` crate, which contains a security vulnerability
(https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
vulnerability is fixed in more recent releases of `time`, but `chrono`
still uses v0.1.

## Solution

Fortunately, the `time` crate now has its own timestamp formatting
support.

This branch replaces the `ChronoLocal` and `ChronoUtc` timestamp
formatters with new `LocalTime` and `UtcTime` formatters. These
formatters use the `time` crate's formatting APIs rather than
`chrono`'s. This removes the vulnerable dependency on `time` 0.1

Additionally, the new `time` APIs are feature flagged as an _opt-in_
feature, rather than as an _opt-out_ feature. This should make it easier
to avoid accidentally depending on the `time` crate when more
sophisticated timestamp formatting is _not_ required.

In a follow-up branch, we could also add support for `humantime` as an
option for timestamp formatting.

Naturally, since this removes existing APIs, this is a breaking change,
and will thus require publishing `tracing-subscriber` 0.3. We'll want to
do some other breaking changes as well.

Fixes #1598.
@hawkw hawkw requested review from jonhoo and davidbarsky October 18, 2021 18:05
@hawkw hawkw self-assigned this Oct 18, 2021
@hawkw hawkw requested a review from a team as a code owner October 18, 2021 18:05
@hawkw
Copy link
Member Author

hawkw commented Oct 18, 2021

The security audit check fails because tracing-appender also depends on chrono, which will be fixed in a separate PR.

davidbarsky
davidbarsky requested changes Oct 18, 2021
View reviewed changes
hawkw and others added 2 commits October 18, 2021 12:54
@hawkw @davidbarsky
Apply suggestions from code review
7891597 
Co-authored-by: David Barsky <me@davidbarsky.com>
@hawkw @davidbarsky
Update tracing-subscriber/src/fmt/time/time_crate.rs
1dd2e10 
Co-authored-by: David Barsky <me@davidbarsky.com>
@hawkw hawkw requested a review from davidbarsky October 18, 2021 19:56
@hawkw hawkw merged commit 6614b2f into master Oct 18, 2021
@hawkw hawkw deleted the eliza/no-time-to-die branch October 18, 2021 20:42
@davidbarsky davidbarsky mentioned this pull request Oct 19, 2021
Merged
@Adam-Gleave Adam-Gleave mentioned this pull request Oct 20, 2021
Open
4 tasks
hawkw added a commit that referenced this pull request Oct 21, 2021
@hawkw
subscriber: replace chrono with time for timestamp formatting (#1646
6219cc7 
)

## Motivation

Currently, `tracing-subscriber` supports the `chrono` crate for
timestamp formatting, via a default-on feature flag. When this code was
initially added to `tracing-subscriber`, the `time` crate did not have
support for the timestamp formatting options we needed.

Unfortunately, the `chrono` crate's maintainance status is now in
question (see #1598). Furthermore, `chrono` depends on version 0.1 of
the `time` crate, which contains a security vulnerability
(https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
vulnerability is fixed in more recent releases of `time`, but `chrono`
still uses v0.1.

## Solution

Fortunately, the `time` crate now has its own timestamp formatting
support.

This branch replaces the `ChronoLocal` and `ChronoUtc` timestamp
formatters with new `LocalTime` and `UtcTime` formatters. These
formatters use the `time` crate's formatting APIs rather than
`chrono`'s. This removes the vulnerable dependency on `time` 0.1

Additionally, the new `time` APIs are feature flagged as an _opt-in_
feature, rather than as an _opt-out_ feature. This should make it easier
to avoid accidentally depending on the `time` crate when more
sophisticated timestamp formatting is _not_ required.

In a follow-up branch, we could also add support for `humantime` as an
option for timestamp formatting.

Naturally, since this removes existing APIs, this is a breaking change,
and will thus require publishing `tracing-subscriber` 0.3. We'll want to
do some other breaking changes as well.

Fixes #1598.
@hawkw hawkw mentioned this pull request Oct 21, 2021
Merged
hawkw added a commit that referenced this pull request Oct 21, 2021
@hawkw
subscriber: replace chrono with time for timestamp formatting (#1646
3634c91 
)

## Motivation

Currently, `tracing-subscriber` supports the `chrono` crate for
timestamp formatting, via a default-on feature flag. When this code was
initially added to `tracing-subscriber`, the `time` crate did not have
support for the timestamp formatting options we needed.

Unfortunately, the `chrono` crate's maintainance status is now in
question (see #1598). Furthermore, `chrono` depends on version 0.1 of
the `time` crate, which contains a security vulnerability
(https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
vulnerability is fixed in more recent releases of `time`, but `chrono`
still uses v0.1.

## Solution

Fortunately, the `time` crate now has its own timestamp formatting
support.

This branch replaces the `ChronoLocal` and `ChronoUtc` timestamp
formatters with new `LocalTime` and `UtcTime` formatters. These
formatters use the `time` crate's formatting APIs rather than
`chrono`'s. This removes the vulnerable dependency on `time` 0.1

Additionally, the new `time` APIs are feature flagged as an _opt-in_
feature, rather than as an _opt-out_ feature. This should make it easier
to avoid accidentally depending on the `time` crate when more
sophisticated timestamp formatting is _not_ required.

In a follow-up branch, we could also add support for `humantime` as an
option for timestamp formatting.

Naturally, since this removes existing APIs, this is a breaking change,
and will thus require publishing `tracing-subscriber` 0.3. We'll want to
do some other breaking changes as well.

Fixes #1598.
hawkw pushed a commit that referenced this pull request Oct 22, 2021
@davidbarsky
appender: replace chrono with time (#1652)
336f8ca 
## Motivation

This PR continues the work started in
#1646 to replace `chrono` with
`time`. I'll refer to @hawkw's motivation:

> Currently, `tracing-subscriber` supports the `chrono` crate for
> timestamp formatting, via a default-on feature flag. When this code
> was initially added to `tracing-subscriber`, the `time` crate did not
> have support for the timestamp formatting options we needed.
>
> Unfortunately, the `chrono` crate's maintenance status is now in
> question (see #1598). Furthermore, `chrono` depends on version 0.1 of
> the `time` crate, which contains a security vulnerability
> (https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
> vulnerability is fixed in more recent releases of `time`, but `chrono`
> still uses v0.1.

## Solution

I've replaced chrono with time 0.3. Unfortunately, some of chrono's
builders for DateTimes are not present in `time`, which required the
usage of `macro_rules!` macros to construct some of the hard-coded
times. I also took the opportunity to tidy some of the tests and change
the internal representation of `Rotation::NEVER` from year 9,999 to an
`Option::None`.

This branch changes `tracing-appender`'s MSRV from Rust 1.42 to Rust
1.51, the MSRV for the `time` crate when certain required feature flags
are enabled. This does *not* effect the MSRV for other crates in this
repository.
hawkw pushed a commit that referenced this pull request Oct 22, 2021
@davidbarsky @hawkw
appender: replace chrono with time (#1652)
957b5e3 
## Motivation

This PR continues the work started in
#1646 to replace `chrono` with
`time`. I'll refer to @hawkw's motivation:

> Currently, `tracing-subscriber` supports the `chrono` crate for
> timestamp formatting, via a default-on feature flag. When this code
> was initially added to `tracing-subscriber`, the `time` crate did not
> have support for the timestamp formatting options we needed.
>
> Unfortunately, the `chrono` crate's maintenance status is now in
> question (see #1598). Furthermore, `chrono` depends on version 0.1 of
> the `time` crate, which contains a security vulnerability
> (https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
> vulnerability is fixed in more recent releases of `time`, but `chrono`
> still uses v0.1.

## Solution

I've replaced chrono with time 0.3. Unfortunately, some of chrono's
builders for DateTimes are not present in `time`, which required the
usage of `macro_rules!` macros to construct some of the hard-coded
times. I also took the opportunity to tidy some of the tests and change
the internal representation of `Rotation::NEVER` from year 9,999 to an
`Option::None`.

This branch changes `tracing-appender`'s MSRV from Rust 1.42 to Rust
1.51, the MSRV for the `time` crate when certain required feature flags
are enabled. This does *not* effect the MSRV for other crates in this
repository.
hawkw pushed a commit that referenced this pull request Oct 22, 2021
@davidbarsky @hawkw
appender: replace chrono with time (#1652)
c62dac9 
## Motivation

This PR continues the work started in
#1646 to replace `chrono` with
`time`. I'll refer to @hawkw's motivation:

> Currently, `tracing-subscriber` supports the `chrono` crate for
> timestamp formatting, via a default-on feature flag. When this code
> was initially added to `tracing-subscriber`, the `time` crate did not
> have support for the timestamp formatting options we needed.
>
> Unfortunately, the `chrono` crate's maintenance status is now in
> question (see #1598). Furthermore, `chrono` depends on version 0.1 of
> the `time` crate, which contains a security vulnerability
> (https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
> vulnerability is fixed in more recent releases of `time`, but `chrono`
> still uses v0.1.

## Solution

I've replaced chrono with time 0.3. Unfortunately, some of chrono's
builders for DateTimes are not present in `time`, which required the
usage of `macro_rules!` macros to construct some of the hard-coded
times. I also took the opportunity to tidy some of the tests and change
the internal representation of `Rotation::NEVER` from year 9,999 to an
`Option::None`.

This branch changes `tracing-appender`'s MSRV from Rust 1.42 to Rust
1.51, the MSRV for the `time` crate when certain required feature flags
are enabled. This does *not* effect the MSRV for other crates in this
repository.
hawkw added a commit that referenced this pull request Oct 22, 2021
@hawkw
subscriber: prepare to release v0.3.0
02f23b8 
# 0.3.0 (Oct 22, 2021)

This is a breaking release of `tracing-subscriber`. The primary breaking
change in this release is the removal of the dependency on the [`chrono`
crate], due to [RUSTSEC-2020-0159]. To replace `chrono`, support is
added for formatting timestamps using the [`time` crate] instead.

In addition, this release includes a number of other breaking API
changes, such as adding (limited) support for `#![no_std]` targets,
removing previously deprecated APIs, and more.

### Breaking Changes

- Removed APIs deprecated in the v0.2.x release series.
- Renamed `Layer::new_span` to `Layer::on_new_span` ([#1674])
- Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn Layer<S> +
  ...>` ([#1649])
- Replaced the [`chrono` crate] with the [`time` crate] for timestamp
  formatting, to resolve [RUSTSEC-2020-0159] ([#1646])
- Removed `json` and `env-filter` from default features. They must now
  be enabled explictly ([#1647])
- Changed `FormatEvent::format_event` and `FormatFields::format_fields`
  trait methods to take a `Writer` type, rather than a `&mut dyn
  fmt::Write` trait object ([#1661])
- Changed the signature of the `MakeWriter` trait by adding a lifetime
  parameter ([#781])
  ### Changed

- **layer**: Renamed `Layer::new_span` to `Layer::on_new_span` ([#1674])
- **fmt**: Changed `FormatEvent::format_event` and
  `FormatFields::format_fields` trait methods to take a `Writer` type,
  rather than a `&mut dyn fmt::Write` trait object ([#1661])
- **json**, **env-filter**: `json` and `env-filter` feature flags are no
  longer enabled by default ([#1647])
  ### Removed

- Removed deprecated `CurrentSpan` type ([#1320])
- **registry**: Removed deprecated `SpanRef::parents` iterator, replaced
  by `SpanRef::scope` in [#1431] ([#1648)])
- **layer**: Removed deprecated `Context::scope` iterator, replaced by
  `Context::span_scope` and `Context::event_scope` in [#1431] and
  [#1434] ([#1648)])
- **layer**: Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn
  Layer<S> + ...>`. These interfere with per-layer filtering. ([#1649])
- **fmt**: Removed deprecated `LayerBuilder` type ([#1673])
- **fmt**: Removed `fmt::Layer::on_event` (renamed to
  `fmt::Layer::fmt_event`) ([#1673])
- **fmt**, **chrono**: Removed the `chrono` feature flag and APIs for
  using the [`chrono` crate] for timestamp formatting ([#1646])
  ### Added

- **fmt**, **time**: `LocalTime` and `UtcTime` types for formatting
  timestamps using the [`time` crate] ([#1646])
- **fmt**: Added a lifetime parameter to the `MakeWriter` trait,
  allowing it to return a borrowed writer. This enables implementations
  of `MakeWriter` for types such as `Mutex<T: io::Write>` and
  `std::fs::File`. ([#781])
- **env-filter**: Documentation improvements ([#1637])
- Support for some APIs on `#![no_std]` targets, by disabling the `std`
  feature flag ([#1660])

Thanks to @Folyd and @nmathewson for contributing to this release!

[#1320]: #1320
[#1673]: #1673
[#1674]: #1674
[#1646]: #1646
[#1647]: #1647
[#1648]: #1648
[#1649]: #1649
[#1660]: #1660
[#1661]: #1661
[#1431]: #1431
[#1434]: #1434
[#781]: #781

[`chrono` crate]: https://crates.io/crates/chrono
[`time` crate]: https://crates.io/crates/time
[RUSTSEC-2020-0159]: https://rustsec.org/advisories/RUSTSEC-2020-0159.html
@hawkw hawkw mentioned this pull request Oct 22, 2021
Merged
hawkw added a commit that referenced this pull request Oct 22, 2021
@hawkw
subscriber: prepare to release v0.3.0 (#1677)
4e56741 
# 0.3.0 (Oct 22, 2021)

This is a breaking release of `tracing-subscriber`. The primary breaking
change in this release is the removal of the dependency on the [`chrono`
crate], due to [RUSTSEC-2020-0159]. To replace `chrono`, support is
added for formatting timestamps using the [`time` crate] instead.

In addition, this release includes a number of other breaking API
changes, such as adding (limited) support for `#![no_std]` targets,
removing previously deprecated APIs, and more.

### Breaking Changes

- Removed APIs deprecated in the v0.2.x release series.
- Renamed `Layer::new_span` to `Layer::on_new_span` ([#1674])
- Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn Layer<S> +
  ...>` ([#1649])
- Replaced the [`chrono` crate] with the [`time` crate] for timestamp
  formatting, to resolve [RUSTSEC-2020-0159] ([#1646])
- Removed `json` and `env-filter` from default features. They must now
  be enabled explictly ([#1647])
- Changed `FormatEvent::format_event` and `FormatFields::format_fields`
  trait methods to take a `Writer` type, rather than a `&mut dyn
  fmt::Write` trait object ([#1661])
- Changed the signature of the `MakeWriter` trait by adding a lifetime
  parameter ([#781])
  ### Changed

- **layer**: Renamed `Layer::new_span` to `Layer::on_new_span` ([#1674])
- **fmt**: Changed `FormatEvent::format_event` and
  `FormatFields::format_fields` trait methods to take a `Writer` type,
  rather than a `&mut dyn fmt::Write` trait object ([#1661])
- **json**, **env-filter**: `json` and `env-filter` feature flags are no
  longer enabled by default ([#1647])
  ### Removed

- Removed deprecated `CurrentSpan` type ([#1320])
- **registry**: Removed deprecated `SpanRef::parents` iterator, replaced
  by `SpanRef::scope` in [#1431] ([#1648)])
- **layer**: Removed deprecated `Context::scope` iterator, replaced by
  `Context::span_scope` and `Context::event_scope` in [#1431] and
  [#1434] ([#1648)])
- **layer**: Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn
  Layer<S> + ...>`. These interfere with per-layer filtering. ([#1649])
- **fmt**: Removed deprecated `LayerBuilder` type ([#1673])
- **fmt**: Removed `fmt::Layer::on_event` (renamed to
  `fmt::Layer::fmt_event`) ([#1673])
- **fmt**, **chrono**: Removed the `chrono` feature flag and APIs for
  using the [`chrono` crate] for timestamp formatting ([#1646])
  ### Added

- **fmt**, **time**: `LocalTime` and `UtcTime` types for formatting
  timestamps using the [`time` crate] ([#1646])
- **fmt**: Added a lifetime parameter to the `MakeWriter` trait,
  allowing it to return a borrowed writer. This enables implementations
  of `MakeWriter` for types such as `Mutex<T: io::Write>` and
  `std::fs::File`. ([#781])
- **env-filter**: Documentation improvements ([#1637])
- Support for some APIs on `#![no_std]` targets, by disabling the `std`
  feature flag ([#1660])

Thanks to @Folyd and @nmathewson for contributing to this release!

[#1320]: #1320
[#1673]: #1673
[#1674]: #1674
[#1646]: #1646
[#1647]: #1647
[#1648]: #1648
[#1649]: #1649
[#1660]: #1660
[#1661]: #1661
[#1431]: #1431
[#1434]: #1434
[#781]: #781

[`chrono` crate]: https://crates.io/crates/chrono
[`time` crate]: https://crates.io/crates/time
[RUSTSEC-2020-0159]: https://rustsec.org/advisories/RUSTSEC-2020-0159.html

Signed-off-by: Eliza Weisman <eliza@buoyant.io>
@complexspaces complexspaces mentioned this pull request Mar 11, 2022
Closed
@patowen patowen mentioned this pull request Aug 13, 2022
Merged
davidbarsky pushed a commit to tokio-rs/tracing-opentelemetry that referenced this pull request Mar 21, 2023
@hawkw
subscriber: prepare to release v0.3.0 (#1677)
ac08040 
# 0.3.0 (Oct 22, 2021)

This is a breaking release of `tracing-subscriber`. The primary breaking
change in this release is the removal of the dependency on the [`chrono`
crate], due to [RUSTSEC-2020-0159]. To replace `chrono`, support is
added for formatting timestamps using the [`time` crate] instead.

In addition, this release includes a number of other breaking API
changes, such as adding (limited) support for `#![no_std]` targets,
removing previously deprecated APIs, and more.

### Breaking Changes

- Removed APIs deprecated in the v0.2.x release series.
- Renamed `Layer::new_span` to `Layer::on_new_span` ([#1674])
- Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn Layer<S> +
  ...>` ([#1649])
- Replaced the [`chrono` crate] with the [`time` crate] for timestamp
  formatting, to resolve [RUSTSEC-2020-0159] ([#1646])
- Removed `json` and `env-filter` from default features. They must now
  be enabled explictly ([#1647])
- Changed `FormatEvent::format_event` and `FormatFields::format_fields`
  trait methods to take a `Writer` type, rather than a `&mut dyn
  fmt::Write` trait object ([#1661])
- Changed the signature of the `MakeWriter` trait by adding a lifetime
  parameter ([#781])
  ### Changed

- **layer**: Renamed `Layer::new_span` to `Layer::on_new_span` ([#1674])
- **fmt**: Changed `FormatEvent::format_event` and
  `FormatFields::format_fields` trait methods to take a `Writer` type,
  rather than a `&mut dyn fmt::Write` trait object ([#1661])
- **json**, **env-filter**: `json` and `env-filter` feature flags are no
  longer enabled by default ([#1647])
  ### Removed

- Removed deprecated `CurrentSpan` type ([#1320])
- **registry**: Removed deprecated `SpanRef::parents` iterator, replaced
  by `SpanRef::scope` in [#1431] ([#1648)])
- **layer**: Removed deprecated `Context::scope` iterator, replaced by
  `Context::span_scope` and `Context::event_scope` in [#1431] and
  [#1434] ([#1648)])
- **layer**: Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn
  Layer<S> + ...>`. These interfere with per-layer filtering. ([#1649])
- **fmt**: Removed deprecated `LayerBuilder` type ([#1673])
- **fmt**: Removed `fmt::Layer::on_event` (renamed to
  `fmt::Layer::fmt_event`) ([#1673])
- **fmt**, **chrono**: Removed the `chrono` feature flag and APIs for
  using the [`chrono` crate] for timestamp formatting ([#1646])
  ### Added

- **fmt**, **time**: `LocalTime` and `UtcTime` types for formatting
  timestamps using the [`time` crate] ([#1646])
- **fmt**: Added a lifetime parameter to the `MakeWriter` trait,
  allowing it to return a borrowed writer. This enables implementations
  of `MakeWriter` for types such as `Mutex<T: io::Write>` and
  `std::fs::File`. ([#781])
- **env-filter**: Documentation improvements ([#1637])
- Support for some APIs on `#![no_std]` targets, by disabling the `std`
  feature flag ([#1660])

Thanks to @Folyd and @nmathewson for contributing to this release!

[#1320]: tokio-rs/tracing#1320
[#1673]: tokio-rs/tracing#1673
[#1674]: tokio-rs/tracing#1674
[#1646]: tokio-rs/tracing#1646
[#1647]: tokio-rs/tracing#1647
[#1648]: tokio-rs/tracing#1648
[#1649]: tokio-rs/tracing#1649
[#1660]: tokio-rs/tracing#1660
[#1661]: tokio-rs/tracing#1661
[#1431]: tokio-rs/tracing#1431
[#1434]: tokio-rs/tracing#1434
[#781]: tokio-rs/tracing#781

[`chrono` crate]: https://crates.io/crates/chrono
[`time` crate]: https://crates.io/crates/time
[RUSTSEC-2020-0159]: https://rustsec.org/advisories/RUSTSEC-2020-0159.html

Signed-off-by: Eliza Weisman <eliza@buoyant.io>
@davidbarsky davidbarsky mentioned this pull request Sep 26, 2023
Merged
kaffarell pushed a commit to kaffarell/tracing that referenced this pull request May 22, 2024
@hawkw @kaffarell
subscriber: replace chrono with time for timestamp formatting (to…
b677fc4 
…kio-rs#1646)

## Motivation

Currently, `tracing-subscriber` supports the `chrono` crate for
timestamp formatting, via a default-on feature flag. When this code was
initially added to `tracing-subscriber`, the `time` crate did not have
support for the timestamp formatting options we needed.

Unfortunately, the `chrono` crate's maintainance status is now in
question (see tokio-rs#1598). Furthermore, `chrono` depends on version 0.1 of
the `time` crate, which contains a security vulnerability
(https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
vulnerability is fixed in more recent releases of `time`, but `chrono`
still uses v0.1.

## Solution

Fortunately, the `time` crate now has its own timestamp formatting
support.

This branch replaces the `ChronoLocal` and `ChronoUtc` timestamp
formatters with new `LocalTime` and `UtcTime` formatters. These
formatters use the `time` crate's formatting APIs rather than
`chrono`'s. This removes the vulnerable dependency on `time` 0.1

Additionally, the new `time` APIs are feature flagged as an _opt-in_
feature, rather than as an _opt-out_ feature. This should make it easier
to avoid accidentally depending on the `time` crate when more
sophisticated timestamp formatting is _not_ required.

In a follow-up branch, we could also add support for `humantime` as an
option for timestamp formatting.

Naturally, since this removes existing APIs, this is a breaking change,
and will thus require publishing `tracing-subscriber` 0.3. We'll want to
do some other breaking changes as well.

Fixes tokio-rs#1598.
kaffarell pushed a commit to kaffarell/tracing that referenced this pull request May 22, 2024
@davidbarsky @kaffarell
appender: replace chrono with time (tokio-rs#1652)
81d4639 
This PR continues the work started in
tokio-rs#1646 to replace `chrono` with
`time`. I'll refer to @hawkw's motivation:

> Currently, `tracing-subscriber` supports the `chrono` crate for
> timestamp formatting, via a default-on feature flag. When this code
> was initially added to `tracing-subscriber`, the `time` crate did not
> have support for the timestamp formatting options we needed.
>
> Unfortunately, the `chrono` crate's maintenance status is now in
> question (see tokio-rs#1598). Furthermore, `chrono` depends on version 0.1 of
> the `time` crate, which contains a security vulnerability
> (https://rustsec.org/advisories/RUSTSEC-2020-0071.html). This
> vulnerability is fixed in more recent releases of `time`, but `chrono`
> still uses v0.1.

I've replaced chrono with time 0.3. Unfortunately, some of chrono's
builders for DateTimes are not present in `time`, which required the
usage of `macro_rules!` macros to construct some of the hard-coded
times. I also took the opportunity to tidy some of the tests and change
the internal representation of `Rotation::NEVER` from year 9,999 to an
`Option::None`.

This branch changes `tracing-appender`'s MSRV from Rust 1.42 to Rust
1.51, the MSRV for the `time` crate when certain required feature flags
are enabled. This does *not* effect the MSRV for other crates in this
repository.
kaffarell pushed a commit to kaffarell/tracing that referenced this pull request May 22, 2024
@hawkw @kaffarell
subscriber: prepare to release v0.3.0 (tokio-rs#1677)
3f21360 
# 0.3.0 (Oct 22, 2021)

This is a breaking release of `tracing-subscriber`. The primary breaking
change in this release is the removal of the dependency on the [`chrono`
crate], due to [RUSTSEC-2020-0159]. To replace `chrono`, support is
added for formatting timestamps using the [`time` crate] instead.

In addition, this release includes a number of other breaking API
changes, such as adding (limited) support for `#![no_std]` targets,
removing previously deprecated APIs, and more.

### Breaking Changes

- Removed APIs deprecated in the v0.2.x release series.
- Renamed `Layer::new_span` to `Layer::on_new_span` ([tokio-rs#1674])
- Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn Layer<S> +
  ...>` ([tokio-rs#1649])
- Replaced the [`chrono` crate] with the [`time` crate] for timestamp
  formatting, to resolve [RUSTSEC-2020-0159] ([tokio-rs#1646])
- Removed `json` and `env-filter` from default features. They must now
  be enabled explictly ([tokio-rs#1647])
- Changed `FormatEvent::format_event` and `FormatFields::format_fields`
  trait methods to take a `Writer` type, rather than a `&mut dyn
  fmt::Write` trait object ([tokio-rs#1661])
- Changed the signature of the `MakeWriter` trait by adding a lifetime
  parameter ([tokio-rs#781])
  ### Changed

- **layer**: Renamed `Layer::new_span` to `Layer::on_new_span` ([tokio-rs#1674])
- **fmt**: Changed `FormatEvent::format_event` and
  `FormatFields::format_fields` trait methods to take a `Writer` type,
  rather than a `&mut dyn fmt::Write` trait object ([tokio-rs#1661])
- **json**, **env-filter**: `json` and `env-filter` feature flags are no
  longer enabled by default ([tokio-rs#1647])
  ### Removed

- Removed deprecated `CurrentSpan` type ([tokio-rs#1320])
- **registry**: Removed deprecated `SpanRef::parents` iterator, replaced
  by `SpanRef::scope` in [tokio-rs#1431] ([tokio-rs#1648)])
- **layer**: Removed deprecated `Context::scope` iterator, replaced by
  `Context::span_scope` and `Context::event_scope` in [tokio-rs#1431] and
  [tokio-rs#1434] ([tokio-rs#1648)])
- **layer**: Removed `Layer` impl for `Arc<L: Layer<S>>` and `Arc<dyn
  Layer<S> + ...>`. These interfere with per-layer filtering. ([tokio-rs#1649])
- **fmt**: Removed deprecated `LayerBuilder` type ([tokio-rs#1673])
- **fmt**: Removed `fmt::Layer::on_event` (renamed to
  `fmt::Layer::fmt_event`) ([tokio-rs#1673])
- **fmt**, **chrono**: Removed the `chrono` feature flag and APIs for
  using the [`chrono` crate] for timestamp formatting ([tokio-rs#1646])
  ### Added

- **fmt**, **time**: `LocalTime` and `UtcTime` types for formatting
  timestamps using the [`time` crate] ([tokio-rs#1646])
- **fmt**: Added a lifetime parameter to the `MakeWriter` trait,
  allowing it to return a borrowed writer. This enables implementations
  of `MakeWriter` for types such as `Mutex<T: io::Write>` and
  `std::fs::File`. ([tokio-rs#781])
- **env-filter**: Documentation improvements ([tokio-rs#1637])
- Support for some APIs on `#![no_std]` targets, by disabling the `std`
  feature flag ([tokio-rs#1660])

Thanks to @Folyd and @nmathewson for contributing to this release!

[tokio-rs#1320]: tokio-rs#1320
[tokio-rs#1673]: tokio-rs#1673
[tokio-rs#1674]: tokio-rs#1674
[tokio-rs#1646]: tokio-rs#1646
[tokio-rs#1647]: tokio-rs#1647
[tokio-rs#1648]: tokio-rs#1648
[tokio-rs#1649]: tokio-rs#1649
[tokio-rs#1660]: tokio-rs#1660
[tokio-rs#1661]: tokio-rs#1661
[tokio-rs#1431]: tokio-rs#1431
[tokio-rs#1434]: tokio-rs#1434
[tokio-rs#781]: tokio-rs#781

[`chrono` crate]: https://crates.io/crates/chrono
[`time` crate]: https://crates.io/crates/time
[RUSTSEC-2020-0159]: https://rustsec.org/advisories/RUSTSEC-2020-0159.html

Signed-off-by: Eliza Weisman <eliza@buoyant.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jhpratt jhpratt jhpratt left review comments

@davidbarsky davidbarsky davidbarsky approved these changes

@jonhoo jonhoo Awaiting requested review from jonhoo

Assignees

@hawkw hawkw

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Replace chrono with time 0.3
3 participants
@hawkw @davidbarsky @jhpratt