This is an automated email from the ASF dual-hosted git repository.
alamb pushed a commit to branch 59_maintenance
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/59_maintenance by this push:
new a098b41ec0 [59_maintenance] chore: update webpki dependencies to fix
cargo audit CI (#11793)
a098b41ec0 is described below
commit a098b41ec0f105ac465f1e9bbdf5dec369cec267
Author: Andrew Lamb <[email protected]>
AuthorDate: Thu Oct 22 04:54:23 2026 -0400
[59_maintenance] chore: update webpki dependencies to fix cargo audit CI
(#11793)
# Which issue does this PR close?
- Part of #11664 (59.3.2 release)
# Rationale for this change
The `Audit` job fails on pushes to `59_maintenance` (for example
https://github.com/apache/arrow-rs/actions/runs/39722525650/job/119639022597)
because two advisories were published against versions pinned in the
committed `Cargo.lock`:
- RUSTSEC-2026-0382: `rustls-webpki` 0.103.15 (fixed in 0.103.16)
- RUSTSEC-2026-0381: `webpki-roots` 1.0.7 (fixed in 1.0.10)
This is the same fix as #11752 on `main`.
# What changes are included in this PR?
Update only the two flagged crates in `Cargo.lock`:
```
cargo update -p rustls-webpki -p webpki-roots
```
Verified locally that `cargo audit --ignore RUSTSEC-2026-0194 --ignore
RUSTSEC-2026-0195` (the CI invocation) passes, and that the lockfile
resolves with `cargo +1.85.0 metadata --locked`. Both new versions have
`rust-version = "1.71"`, below the workspace MSRV of 1.85.
# Are these changes tested?
CI
# Are there any user-facing changes?
No. This only affects the lockfile used for workspace builds and CI.
Co-authored-by: Claude Fable 5.1 <[email protected]>
---
Cargo.lock | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 93d2d411f5..aecbf188da 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3025,9 +3025,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@@ -4024,9 +4024,9 @@ dependencies = [
[[package]]
name = "webpki-roots"
-version = "1.0.7"
+version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
