This is an automated email from the ASF dual-hosted git repository.
alamb pushed a commit to branch 58_maintenance
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/58_maintenance by this push:
new 7c166f8c19 [58_maintenance] chore: update webpki dependencies to fix
cargo audit CI (#11794)
7c166f8c19 is described below
commit 7c166f8c192558b55eea45e9250facebc7beb855
Author: Andrew Lamb <[email protected]>
AuthorDate: Thu Oct 22 05:04:08 2026 -0400
[58_maintenance] chore: update webpki dependencies to fix cargo audit CI
(#11794)
# Which issue does this PR close?
- Part of #11665 (58.4.1 release)
# Rationale for this change
The `Audit` job fails on `58_maintenance` because two advisories were
published against versions pinned in the committed `Cargo.lock`:
- RUSTSEC-2026-0382: `rustls-webpki` 0.103.15 (fixed in 0.103.16)
- RUSTSEC-2026-0381: `webpki-roots` 1.0.9 (fixed in 1.0.10)
Reproduced locally by running the CI `cargo audit` invocation (with the
workflow's `--ignore` list) against the branch, which reports exactly
these two vulnerabilities.
This is the same fix as #11752 on `main` and #11793 on `59_maintenance`.
# What changes are included in this PR?
Update only the two flagged crates in `Cargo.lock`:
```
cargo update -p rustls-webpki -p webpki-roots
```
Verified locally that the CI `cargo audit` invocation passes afterwards,
and that the lockfile resolves with `cargo +1.85.0 metadata --locked`.
Both new versions have `rust-version = "1.71"`, below the workspace MSRV
of 1.85.
# Are these changes tested?
CI
# Are there any user-facing changes?
No. This only affects the lockfile used for workspace builds and CI.
Co-authored-by: Claude Fable 5.1 <[email protected]>
---
Cargo.lock | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 9247199b45..68cfcec11d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3028,9 +3028,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@@ -3369,7 +3369,7 @@ source =
"registry+https://github.com/rust-lang/crates.io-index";
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.61.2",
@@ -3982,9 +3982,9 @@ dependencies = [
[[package]]
name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
