Configure zip not to use its time feature

This is the second half of getting us out of the position of depending on the vulnerable version of `time`.
volta-cli · Dec 20, 2023 · 59e272a · 59e272a
1 parent f594000
commit 59e272a
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 13 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/archive/Cargo.toml b/crates/archive/Cargo.toml
@@ -7,7 +7,10 @@ edition = "2018"
 [dependencies]
 flate2 = "1.0"
 tar = "0.4.13"
-zip_rs = { version = "0.5", package = "zip" }
+# Set features manually to drop usage of `time` crate: we do not rely on that
+# set of capabilities, and it has a vulnerability. NOTE: this should be updated
+# to include the `aes-crypto` and `zstd` features when upgrading to v0.6+.
+zip_rs = { version = "0.5", package = "zip", default-features = false, features = ["deflate", "bzip2"] }
 tee = "0.1.0"
 fs-utils = { path = "../fs-utils" }
 progress-read = { path = "../progress-read" }