cargo audit issues found in the most recent crates.io release

[VorpalBlade]

Some (or all?) of these appear to be fixed in git already, but since there hasn't been a recent release the version you get with cargo install is still affected.

$ cargo audit bin /home/user/.cargo/bin/cargo-cache
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 537 security advisories (from /home/user/.cargo/advisory-db)
    Updating crates.io index
       Found 'cargo auditable' data in /home/user/.cargo/bin/cargo-cache (78 dependencies)
Crate:     chrono
Version:   0.4.19
Title:     Potential segfault in `localtime_r` invocations
Date:      2020-11-10
ID:        RUSTSEC-2020-0159
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0159
Solution:  Upgrade to >=0.4.20
Dependency tree:
chrono 0.4.19
└── cargo-cache 0.8.3

Crate:     libgit2-sys
Version:   0.13.2+1.4.2
Title:     git2 does not verify SSH keys by default
Date:      2023-01-20
ID:        RUSTSEC-2023-0003
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0003
Solution:  Upgrade to >=0.13.5, <0.14.0 OR >=0.14.2
Dependency tree:
libgit2-sys 0.13.2+1.4.2
└── git2 0.14.2
    └── cargo-cache 0.8.3

Crate:     remove_dir_all
Version:   0.7.0
Title:     Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)
Date:      2023-02-24
ID:        RUSTSEC-2023-0018
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0018
Solution:  Upgrade to >=0.8.0
Dependency tree:
remove_dir_all 0.7.0
└── cargo-cache 0.8.3

Crate:     time
Version:   0.1.44
Title:     Potential segfault in the time crate
Date:      2020-11-18
ID:        RUSTSEC-2020-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0071
Severity:  6.2 (medium)
Solution:  Upgrade to >=0.2.23
Dependency tree:
time 0.1.44
└── chrono 0.4.19
    └── cargo-cache 0.8.3

Crate:     atty
Version:   0.2.14
Warning:   unsound
Title:     Potential unaligned read
Date:      2021-07-04
ID:        RUSTSEC-2021-0145
URL:       https://rustsec.org/advisories/RUSTSEC-2021-0145
Dependency tree:
atty 0.2.14
└── clap 3.2.15
    └── cargo-cache 0.8.3

error: 4 vulnerabilities found in /home/user/.cargo/bin/cargo-cache
warning: 1 allowed warning found in /home/user/.cargo/bin/cargo-cache

[matthiaskrgr]

Yeah, should get another release out soonish..
From skipping over the list, the remove-dir-all one is the only one that seems kinda concerning to me right now but the others for sure would also be nice to (not) have :)