chore: suppress humantime advisory (#3529)

The `humantime` package is no longer maintained. We should move to avoid
using it. We were using it indirectly via `env_logger` and
`object_store`. This PR updates `env_logger` to the latest version
(which uses `jiff` instead of `humantime`).

`object_store` is one of our core dependencies and we generally update
it as new versions are released. If (and when) `humantime` is replaced
with `jiff` we will remove the dependency then. This may be several
months. apache/arrow-rs#7261 can be used for
tracking.

Until then we should suppress the advisory.

Author: westonpace

Cargo.lock

@@ -83,6 +83,7 @@ ignore = [
     { id = "RUSTSEC-2021-0153", reason = "`encoding` is used by lindera" },
     { id = "RUSTSEC-2024-0384", reason = "`instant` is used by tantivy" },
     { id = "RUSTSEC-2024-0436", reason = "`paste` is used by datafusion" },
+    { id = "RUSTSEC-2025-0014", reason = "`humantime` is used by object_store" },
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.

deny.toml

@@ -20,7 +20,7 @@ arrow-select = "54.1"
 object_store = "0.11.2"
 async-trait = "0.1"
 chrono = "0.4.31"
-env_logger = "0.10"
+env_logger = "0.11.7"
 futures = "0.3"
 half = { version = "2.3", default-features = false, features = [
     "num-traits",

python/Cargo.lock

@@ -94,7 +94,7 @@ all_asserts = "2.3.1"
 mock_instant.workspace = true
 lance-testing = { workspace = true }
 tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
-env_logger = "0.10.0"
+env_logger = "0.11.7"
 tracing-chrome = "0.7.1"
 rstest = { workspace = true }
 random_word = { version = "0.4.3", features = ["en"] }