This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-3538-cfa8b9c4c2828f480dbbd167486e91009915418a in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
commit e4f928acf70ff362c83f0fc4961bf7fc651ea00b Author: Danny C Jones <[email protected]> AuthorDate: Mon Oct 26 18:26:11 2026 +0000 chore(deps): Address or ignore zstd advisories (#3538) * chore(deps): bump zstd-sys to 2.1.2 to fix RUSTSEC-2026-0410 Co-authored-by: Danny C Jones <[email protected]> * ci: ignore unreachable zstd RUSTSEC advisories pending zstd 0.14 upstream Co-authored-by: Danny C Jones <[email protected]> * Address comments from Copilot Co-authored-by: Danny C Jones <[email protected]> * ci: clarify zstd advisory ignore rationale and removal condition Map each ignored advisory to why it is unreachable, add a command to re-check enabled zstd features, and include the workspace zstd bump in the removal condition. Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Kevin Liu <[email protected]> Co-authored-by: Copilot App <[email protected]> --- .cargo/audit.toml | 17 +++++++++++++++++ Cargo.lock | 4 ++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 706ff2edc..e9e875e7c 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -32,4 +32,21 @@ ignore = [ # 1.0.10, but cargo-audit flags it by version number. Remove once sqlx moves # to webpki-roots 1.x directly. "RUSTSEC-2026-0381", + # `zstd` < 0.14.3 / `zstd-safe` < 8.2.0 memory-safety bugs. + # + # Fixed only in zstd 0.14, but parquet 59 and apache-avro 0.22 require + # zstd 0.13. Remove once on parquet >= 60 + # (https://github.com/apache/iceberg-rust/pull/3257), an apache-avro release + # after 0.22, and workspace `zstd` >= 0.14.3. + # + # None of the affected code is reachable here. To re-check, run + # `cargo tree --workspace --all-features --target all -e features -i zstd-safe` + # and confirm only `std` is enabled. + # + # Affects only zstd's `with_context` constructors, which nothing calls. + "RUSTSEC-2026-0391", + # Requires the `seekable` feature, which is off. + "RUSTSEC-2026-0398", + # Requires the `legacy` feature, which is off. + "RUSTSEC-2026-0403", ] diff --git a/Cargo.lock b/Cargo.lock index 2b057687b..801e4597c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8046,9 +8046,9 @@ dependencies = [ [[package]] name = "zstd-sys" -version = "2.0.16+zstd.1.5.7" +version = "2.1.2+zstd.1.5.7" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748" +checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3" dependencies = [ "cc", "pkg-config",
