diff --git a/Cargo.toml b/Cargo.toml
index 0c12782bd..fd0262cbb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -38,7 +38,7 @@ async-trait = "0.1.64"
 backoff = "0.4.0"
 base64 = "0.22.0"
 bytes = "1.1.0"
-chrono = { version = "0.4.23", default-features = false }
+chrono = { version = "0.4.32", default-features = false }
 darling = "0.20.3"
 derivative = "2.1.1"
 either = "1.6.1"
@@ -58,7 +58,6 @@ hyper-timeout = "0.5.1"
 json-patch = "1.0.0"
 jsonpath-rust = "0.5.0"
 k8s-openapi = { version = "0.21.0", default-features = false }
-once_cell = "1.8.0"
 openssl = "0.10.36"
 parking_lot = "0.12.0"
 pem = "3.0.1"
diff --git a/deny.toml b/deny.toml
index 791eab902..b8d32fdaa 100644
--- a/deny.toml
+++ b/deny.toml
@@ -10,19 +10,6 @@ vulnerability = "deny"
 unmaintained = "warn"
 yanked = "warn"
 notice = "warn"
-ignore = [
-    # Ignoring issues related to `localtime_r` for now
-    # See https://github.com/kube-rs/kube/issues/650
-    #
-    # Potential segfault in the `time` crate
-    # Tracking issue: https://github.com/kube-rs/kube/issues/656
-    # PR to update `time`: https://github.com/chronotope/chrono/pull/578
-    "RUSTSEC-2020-0071",
-    # Potential segfault in `localtime_r` invocations
-    # Tracking issue: https://github.com/kube-rs/kube/issues/660
-    # Upstream issue: https://github.com/chronotope/chrono/issues/499
-    "RUSTSEC-2020-0159",
-]
 
 
 [licenses]
@@ -41,7 +28,6 @@ allow = [
     "BSD-3-Clause",
     "ISC",
     "LicenseRef-ring",
-    "LicenseRef-webpki",
 ]
 
 exceptions = [
@@ -61,22 +47,6 @@ license-files = [
     { path = "LICENSE", hash = 0xbd0eed23 },
 ]
 
-
-[[licenses.clarify]]
-name = "webpki"
-expression = "LicenseRef-webpki"
-license-files = [
-    { path = "LICENSE", hash = 0x001c7e6c },
-]
-
-# rustls' webpki fork uses same license https://github.com/rustls/webpki
-[[licenses.clarify]]
-name = "rustls-webpki"
-expression = "LicenseRef-webpki"
-license-files = [
-    { path = "LICENSE", hash = 0x001c7e6c },
-]
-
 [sources]
 unknown-registry = "deny"
 unknown-git = "deny"
@@ -98,14 +68,6 @@ name = "syn"
 # https://github.com/jcreekmore/pem-rs/blob/master/Cargo.toml#L16
 name = "base64"
 
-[[bans.skip]]
-# used by h2->hyper->hyper-openssl (we have latest)
-# newer used by serde_json
-name = "indexmap"
-[[bans.skip]]
-# via indexmap - have to also skip this
-name = "hashbrown"
-
 [[bans.skip]]
 # latest via openssl->hyper-openssl (we have latest)
 # newer via tower-http (we have latest)
@@ -117,7 +79,3 @@ name = "redox_syscall"
 
 [[bans.skip-tree]]
 name = "windows-sys"
-
-[[bans.skip]]
-# deep in dependency tree, dual use via tokio and hyper  (needs a bump there)
-name = "socket2"
diff --git a/kube-core/Cargo.toml b/kube-core/Cargo.toml
index 8fb7fb68d..9b38f0335 100644
--- a/kube-core/Cargo.toml
+++ b/kube-core/Cargo.toml
@@ -32,8 +32,7 @@ thiserror.workspace = true
 form_urlencoded.workspace = true
 http.workspace = true
 json-patch = { workspace = true, optional = true }
-once_cell.workspace = true
-chrono = { workspace = true, features = ["clock"] }
+chrono = { workspace = true, features = ["now"] }
 schemars = { workspace = true, optional = true }
 k8s-openapi.workspace = true
 
diff --git a/kube-core/src/resource.rs b/kube-core/src/resource.rs
index 4b159b3bc..82a6f5570 100644
--- a/kube-core/src/resource.rs
+++ b/kube-core/src/resource.rs
@@ -216,10 +216,7 @@ pub trait ResourceExt: Resource {
     fn managed_fields_mut(&mut self) -> &mut Vec<ManagedFieldsEntry>;
 }
 
-// TODO: replace with ordinary static when BTreeMap::new() is no longer
-// const-unstable.
-use once_cell::sync::Lazy;
-static EMPTY_MAP: Lazy<BTreeMap<String, String>> = Lazy::new(BTreeMap::new);
+static EMPTY_MAP: BTreeMap<String, String> = BTreeMap::new();
 
 impl<K: Resource> ResourceExt for K {
     fn name_unchecked(&self) -> String {
@@ -251,7 +248,7 @@ impl<K: Resource> ResourceExt for K {
     }
 
     fn labels(&self) -> &BTreeMap<String, String> {
-        self.meta().labels.as_ref().unwrap_or(&*EMPTY_MAP)
+        self.meta().labels.as_ref().unwrap_or(&EMPTY_MAP)
     }
 
     fn labels_mut(&mut self) -> &mut BTreeMap<String, String> {
@@ -259,7 +256,7 @@ impl<K: Resource> ResourceExt for K {
     }
 
     fn annotations(&self) -> &BTreeMap<String, String> {
-        self.meta().annotations.as_ref().unwrap_or(&*EMPTY_MAP)
+        self.meta().annotations.as_ref().unwrap_or(&EMPTY_MAP)
     }
 
     fn annotations_mut(&mut self) -> &mut BTreeMap<String, String> {