Repository: arrayfire/arrayfire-rust (language: rust)

Issue:
[Build] RUSTSEC-2020-0071: Potential segfault in the time crate
# Description
`arrayfire-rust` depends on the `mnist` package that in turn depends on the `time` crate.

The following security advisory was raised tonight regarding the `time` crate: https://github.com/c0dearm/mushin/issues/16

I think there are a few things to do here:
* Upgrade the `mnist` package so that the security vulnerability is not there anymore.
* Set up a GitHub workflow to check for package vulnerabilities (like it is done in the `mushin` project)
* Is `mnist` really a required dependency? Would it be possible to have it only as a dev dependency or in a Cargo feature flag?


Discussion / hints:

Fix patch:
diff --git a/Cargo.toml b/Cargo.toml
index dc1cc9d1..97553800 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -53,13 +53,13 @@ libc = "0.2"
 num  = "0.4.0"
 lazy_static = "1.0"
 half = "1.5.0"
-mnist = {version="0.5.0", features = ["download"]}
 serde = { version = "1.0", features = ["derive"], optional = true }
 
 [dev-dependencies]
 half = "1.5.0"
 serde_json = "1.0"
 bincode = "1.3"
+mnist = {version="0.5.0", features = ["download"]}
 
 [build-dependencies]
 serde_json = "1.0"


Test patch: