This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-3486-5c27157675a7babb611638786195dfe24ad41dab in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
commit 86e837f90d16074d67218db05ffc2629443dafd5 Author: Kevin Liu <[email protected]> AuthorDate: Thu Oct 22 09:30:29 2026 +0000 chore: clean up audit ignores and cite LEGAL-732 in deny.toml (#3486) * chore: remove stale quick-xml advisory ignores Cargo.lock now resolves quick-xml to 0.41.0, which contains the fix for RUSTSEC-2026-0194 and RUSTSEC-2026-0195. `cargo audit` passes without the ignores, so they no longer suppress anything. The rsa (RUSTSEC-2023-0071) and paste (RUSTSEC-2024-0436) ignores stay: both crates are still in Cargo.lock and `cargo audit` fails without them. Co-authored-by: Copilot App <[email protected]> * chore: cite ASF LEGAL-732 for CDLA-Permissive-2.0 in deny.toml CDLA-Permissive-2.0 was allowed without a justification. ASF LEGAL-732 treats it as Category A, the same reference Apache OpenDAL cites in its deny.toml. Document it so reviewers can see why it is on the allowlist. Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]> --- .cargo/audit.toml | 12 ------------ deny.toml | 1 + 2 files changed, 1 insertion(+), 12 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index a2c3f0f6f..706ff2edc 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -25,18 +25,6 @@ ignore = [ # # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293 "RUSTSEC-2024-0436", - # `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and - # unbounded namespace-declaration allocation (parser DoS). - # - # It is transitive through object_store 0.13.2 (DataFusion 53 / Parquet 58), - # OpenDAL 0.57.0, and reqsign-aws-v4 3.0.0. Their released compatible - # versions cannot select the fixed quick-xml >=0.41.0 release. - # - # Per SECURITY-THREAT-MODEL.md, malformed-input parser CPU/memory DoS is - # hardening rather than an Iceberg Rust trust-boundary vulnerability. Remove - # once the transitive dependency set permits quick-xml >=0.41.0. - "RUSTSEC-2026-0194", - "RUSTSEC-2026-0195", # `webpki-roots` < 1.0.10 bundles a distrusted emSign root. # # sqlx-core 0.8.6 pulls in webpki-roots 0.26.11, the final 0.26.x release. diff --git a/deny.toml b/deny.toml index 30c911439..351d8fa47 100644 --- a/deny.toml +++ b/deny.toml @@ -29,6 +29,7 @@ allow = [ "ISC", "CC0-1.0", "Zlib", + # Category-A: https://issues.apache.org/jira/browse/LEGAL-732 "CDLA-Permissive-2.0", # Category-A: https://issues.apache.org/jira/browse/LEGAL-660 "Unicode-3.0",
