crates.io / chrono / 0.4.45

chrono 0.4.45

Source

https://github.com/chronotope/chrono

Artifact scanned

chrono-0.4.45.crate (crate · 235.2 KB · SHA-256 1aa79e62e769…)

Compared with

chrono-0.4.44.crate (0 signals introduced since)

Files

46 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-24 05:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info critical → info by review encoding-escape-soup src/offset/local/tz_info/timezone.rs:716:126

   35 consecutive `\xNN` escapes (entropy 4.7 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.80)

   06\0\0\0\0\0\0\0\x07\0\0\0\x06\0\0\0\x14\x80\0\0\0\xbb\x05\x43\x48\xbb\x21\x71\x58\xcb\x89\x3d\xc8\xd2\x23\xf4\x70\xd2\x61\x49\x38\xd5\x8d\x73\x48\x01\x02\x01\x03\x04\x01\x05\xff\xff\x6c\x02\0\0\xff\xff\x6c\x58\0\x04\xff\xff\x7a\x68\x01\x08\xff\xff\x7a\x68\x01\x0c\xff\xff\x7a\x68\x01\x10\xff\xff\x73\x60\0\x04LMT\0HST\0

   likely benign LLM, confidence 0.95 A Rust byte-string literal holding a binary TZif timezone fixture used in tests.

   Reasoning

   The escaped bytes are a TZif binary timezone file (magic-like header, transition times, LMT/HST abbreviations) embedded as a byte-string literal in a Rust test. Such fixtures are normal for timezone parsing tests. The 'unsafe block' elevation is unrelated to the data itself, and nothing here decodes or executes anything.

2. info critical → info by review encoding-escape-soup src/offset/local/tz_info/timezone.rs:716:528

   68 consecutive `\xNN` escapes (entropy 3.7 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.80)

   \0\x06\0\0\0\x06\0\0\0\0\0\0\0\x07\0\0\0\x06\0\0\0\x14\xff\xff\xff\xff\x74\xe0\x70\xbe\xff\xff\xff\xff\xbb\x05\x43\x48\xff\xff\xff\xff\xbb\x21\x71\x58\xff\xff\xff\xff\xcb\x89\x3d\xc8\xff\xff\xff\xff\xd2\x23\xf4\x70\xff\xff\xff\xff\xd2\x61\x49\x38\xff\xff\xff\xff\xd5\x8d\x73\x48\x01\x02\x01\x03\x04\x01\x05\xff\xff\x6c\x

   likely benign LLM, confidence 0.95 Continuation of an embedded binary TZif timezone fixture in a Rust test file.

   Reasoning

   This is a continuation of the same embedded TZif binary test fixture (transition data and type records ending in LMT/HST abbreviations). It is static test data in a timezone parser, with no decoding, execution, or network activity in the snippet.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o chrono-0.4.45.crate 'https://static.crates.io/crates/chrono/chrono-0%2E4%2E45.crate'
printf '%s  %s\n' 1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327 chrono-0.4.45.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf chrono-0.4.45.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg