This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-3496-e4b9c3ef20335bbc41b079cfd795aafc5fc9be60 in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
commit 219571a4185df2bc6e144dbbcb72cf016714b61b Author: Dhruv Arya <[email protected]> AuthorDate: Tue Oct 20 21:07:52 2026 +0000 fix: update rustls-webpki and webpki-roots for emSign advisories (#3496) * fix: update rustls-webpki and webpki-roots for emSign advisories Bump rustls-webpki to 0.103.16 and webpki-roots / webpki-root-certs to 1.0.10 to address RUSTSEC-2026-0382, RUSTSEC-2026-0381 and RUSTSEC-2026-0383. Ignore RUSTSEC-2026-0381 for the webpki-roots 0.26.11 shim pulled in by sqlx-core 0.8.6, which re-exports the fixed 1.0.10. Co-authored-by: Isaac <[email protected]> * fix: drop unused sqlx TLS dev feature instead of ignoring RUSTSEC-2026-0381 The SQL catalog tests only use SQLite, so the tls-rustls feature on the sqlx dev-dependency is unused. Removing it drops webpki-roots from the lockfile, so the audit ignore is no longer needed. Co-authored-by: Isaac <[email protected]> --------- Co-authored-by: Dhruv Arya <[email protected]> Co-authored-by: Isaac <[email protected]> --- .cargo/audit.toml | 7 +++++++ Cargo.lock | 16 ++++++++-------- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 176d43abf..a2c3f0f6f 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -37,4 +37,11 @@ ignore = [ # once the transitive dependency set permits quick-xml >=0.41.0. "RUSTSEC-2026-0194", "RUSTSEC-2026-0195", + # `webpki-roots` < 1.0.10 bundles a distrusted emSign root. + # + # sqlx-core 0.8.6 pulls in webpki-roots 0.26.11, the final 0.26.x release. + # It only re-exports webpki-roots 1.x, which the lockfile pins to the fixed + # 1.0.10, but cargo-audit flags it by version number. Remove once sqlx moves + # to webpki-roots 1.x directly. + "RUSTSEC-2026-0381", ] diff --git a/Cargo.lock b/Cargo.lock index 41ee99bb6..f0463d1a6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5389,9 +5389,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -6271,7 +6271,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2", @@ -7077,9 +7077,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -7090,14 +7090,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.8", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.8" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ]
