This is an automated email from the ASF dual-hosted git repository.
alamb pushed a commit to branch 58_maintenance
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/58_maintenance by this push:
new d9e13b2d5b [58_maintenance] chore: update tokio to 1.54.1 to fix cargo
audit CI (#11821)
d9e13b2d5b is described below
commit d9e13b2d5b70618e3ad8fe174c4047e8a43f2c44
Author: Andrew Lamb <[email protected]>
AuthorDate: Thu Oct 22 11:32:38 2026 -0400
[58_maintenance] chore: update tokio to 1.54.1 to fix cargo audit CI
(#11821)
# Which issue does this PR close?
- N/A (fixes CI on the `58_maintenance` branch)
# Rationale for this change
The `Audit` job fails on pushes to `58_maintenance` (for example
https://github.com/apache/arrow-rs/actions/runs/39737710459) because an
advisory was published against a version pinned in the committed
`Cargo.lock`:
- [RUSTSEC-2026-0384](https://rustsec.org/advisories/RUSTSEC-2026-0384):
`tokio` 1.54.0 (race condition in `tokio::time::Interval`), fixed in
1.54.1. The 1.54.0 release has also been yanked.
`main` (tokio 1.53.3) and `59_maintenance` (tokio 1.53.1) are not
affected. `57_maintenance` pins the same 1.54.0 and gets the same fix in
https://github.com/apache/arrow-rs/pull/11819.
# What changes are included in this PR?
Update only `tokio` in `Cargo.lock` from 1.54.0 to 1.54.1 (version and
checksum). Running `cargo update -p tokio --precise 1.54.1` also
re-unified the `windows-sys` dependency of five unrelated crates, so
this PR applies just the `tokio` entry to keep the diff minimal.
Verified locally that `cargo audit --ignore RUSTSEC-2026-0194 --ignore
RUSTSEC-2026-0195 --ignore RUSTSEC-2026-0176 --ignore RUSTSEC-2026-0177`
(the CI invocation) passes with only the one already-allowed
`unmaintained` warning, and that the lockfile resolves with `cargo
+1.85.0 metadata --locked`. tokio 1.54.1 has `rust-version = "1.85"`,
matching the workspace MSRV.
# Are these changes tested?
CI
# Are there any user-facing changes?
No. This only affects the lockfile used for workspace builds and CI.
Co-authored-by: Claude Fable 5.1 <[email protected]>
---
Cargo.lock | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 45dad5c410..038688848d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3489,9 +3489,9 @@ checksum =
"fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
[[package]]
name = "tokio"
-version = "1.54.0"
+version = "1.54.1"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
dependencies = [
"bytes",
"libc",
