This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-11922-69be95c1d925bd876c71c11ec6cb2a646d54a1ad in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
commit a19146199774ff2797271c2285321a38272ec48c Author: RIchard Baah <[email protected]> AuthorDate: Mon Oct 26 18:36:02 2026 +0000 chore(ci): ignore unaffected tonic zstd advisories (#11922) ## what caused the merge queue to fail? The merge queue is currently blocked by new RustSec advisories for the zstd 0.13 dependency pulled in by tonic. The same main commit passed audit at 12:32 UTC with 1,355 advisories, then failed at 15:26 UTC after the advisory database grew to 1,378 entries, so this wasn't caused by a recent Arrow change. # fix Tonic doesn't use the affected APIs, and there isn't a tonic release using zstd 0.14 yet. Ignore these advisories for now and remove the ignores once tonic updates zstd. --------- Co-authored-by: Andrew Lamb <[email protected]> --- .github/workflows/audit.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 5792aef411..dfa15307f1 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -37,4 +37,11 @@ jobs: - name: Run audit check # ubuntu-slim has no Rust toolchain to dispatch `cargo audit`, so # call the binary directly. - run: cargo-audit audit + # tonic 0.14 pins zstd 0.13, but its compression codec doesn't use the + # APIs affected by these advisories. Remove these once tonic updates. + # See https://github.com/grpc/grpc-rust/issues/2960 + run: | + cargo-audit audit \ + --ignore RUSTSEC-2026-0391 \ + --ignore RUSTSEC-2026-0398 \ + --ignore RUSTSEC-2026-0403
