This is an automated email from the ASF dual-hosted git repository.
kevinjqliu pushed a commit to branch 0.11.x
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
The following commit(s) were added to refs/heads/0.11.x by this push:
new 284b4fc75 chore(deps): update dependencies to address security
advisories (#3558)
284b4fc75 is described below
commit 284b4fc75091db840480a5df0e7b1750cc41a4ba
Author: Danny C Jones <[email protected]>
AuthorDate: Tue Oct 27 22:23:14 2026 +0000
chore(deps): update dependencies to address security advisories (#3558)
Co-authored-by: Danny C Jones <[email protected]>
Co-authored-by: Copilot App <[email protected]>
Co-authored-by: Kevin Liu <[email protected]>
---
.cargo/audit.toml | 17 +++++++++++++++++
Cargo.lock | 38 +++++++++++++++++++-------------------
bindings/python/about.toml | 15 ++++++---------
3 files changed, 42 insertions(+), 28 deletions(-)
diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 7e31efcb1..7ca117be0 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -64,4 +64,21 @@ ignore = [
# once the transitive dependency set permits quick-xml >=0.41.0.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
+ # `zstd` < 0.14.3 / `zstd-safe` < 8.2.0 memory-safety bugs.
+ #
+ # Fixed only in zstd 0.14, but parquet 58 and apache-avro 0.21 require
+ # zstd 0.13. Remove once on parquet >= 60
+ # (https://github.com/apache/iceberg-rust/pull/3257), an apache-avro release
+ # after 0.21, and workspace `zstd` >= 0.14.3.
+ #
+ # None of the affected code is reachable here. To re-check, run
+ # `cargo tree --workspace --all-features --target all -e features -i
zstd-safe`
+ # and confirm only `std` is enabled.
+ #
+ # Affects only zstd's `with_context` constructors, which nothing calls.
+ "RUSTSEC-2026-0391",
+ # Requires the `seekable` feature, which is off.
+ "RUSTSEC-2026-0398",
+ # Requires the `legacy` feature, which is off.
+ "RUSTSEC-2026-0403",
]
diff --git a/Cargo.lock b/Cargo.lock
index 416e33daf..8bf6fd19a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -632,9 +632,9 @@ dependencies = [
[[package]]
name = "aws-lc-rs"
-version = "1.17.1"
+version = "1.18.1"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
dependencies = [
"aws-lc-sys",
"zeroize",
@@ -642,9 +642,9 @@ dependencies = [
[[package]]
name = "aws-lc-sys"
-version = "0.42.0"
+version = "0.45.0"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
dependencies = [
"cc",
"cmake",
@@ -1811,9 +1811,9 @@ dependencies = [
[[package]]
name = "ctutils"
-version = "0.4.2"
+version = "0.4.5"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
dependencies = [
"cmov",
]
@@ -5973,9 +5973,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.19"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
dependencies = [
"aws-lc-rs",
"bytes",
@@ -6629,9 +6629,9 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.41"
+version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"aws-lc-rs",
"once_cell",
@@ -6693,9 +6693,9 @@ checksum =
"f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@@ -8592,9 +8592,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
-version = "1.0.8"
+version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@@ -8605,14 +8605,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index";
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
@@ -9274,9 +9274,9 @@ dependencies = [
[[package]]
name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
dependencies = [
"cc",
"pkg-config",
diff --git a/bindings/python/about.toml b/bindings/python/about.toml
index a41117000..3c63f79a4 100644
--- a/bindings/python/about.toml
+++ b/bindings/python/about.toml
@@ -67,21 +67,18 @@ license = "MIT"
checksum = "3823dda7cf046602f4b4e77ec8e227863dc4736037cc85bb33d9f19febe16bb7"
path = "LICENSE.txt"
-# zstd-sys vendors zstd's C code (BSD-3-Clause, Meta) next to the Rust
-# bindings (BSD-3-Clause, Facebook); neither is in its Cargo.toml license.
+# zstd-sys's LICENSE covers only its Rust code. Without this, cargo-about omits
+# the Meta copyright notices for the bindings and the vendored zstd C code.
[zstd-sys.clarify]
-license = "MIT AND BSD-3-Clause"
+license = "BSD-3-Clause"
[[zstd-sys.clarify.files]]
-checksum = "129e8edef29e9abcd2ebabe252f4ef1b1289cdca356bf0040284a2fbccfb96c8"
-license = "MIT"
-path = "LICENSE.Mit"
+checksum = "ce4868c8e4ebe47a7d4b3c93dbf6b802033e5ae2fa7638098173f80836daac60"
+path = "LICENSE"
[[zstd-sys.clarify.files]]
-checksum = "48341f685c87304089aa099b23c386f8bacc519ef555aa7a13e239908907b3fd"
-license = "BSD-3-Clause"
+checksum = "bf7017a73a95ea63bf3716b13ec2bcd79c92942356e3408c6fb66332bad6d977"
path = "LICENSE.BSD-3-Clause"
[[zstd-sys.clarify.files]]
checksum = "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8"
-license = "BSD-3-Clause"
path = "zstd/LICENSE"
# aws-lc-sys and aws-lc-rs each ship all of their licenses in one LICENSE file,
