This is an automated email from the ASF dual-hosted git repository.
XiaoHongbo-Hope pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/paimon-full-text.git
The following commit(s) were added to refs/heads/main by this push:
new b30512e Check Rust advisories and update crossbeam-epoch (#18)
b30512e is described below
commit b30512eb97e328cf8f383f7770549c9ac1ec1652
Author: jianguotian <[email protected]>
AuthorDate: Fri Jul 17 18:23:05 2026 +0800
Check Rust advisories and update crossbeam-epoch (#18)
Enable cargo-deny advisory checks, update crossbeam-epoch to 0.9.20, and
narrowly ignore the unmaintained include-flate proc-macro advisory which has no
patched release.
Co-authored-by: mingfeng <[email protected]>
---
.github/workflows/ci.yml | 3 +++
Cargo.lock | 4 ++--
DEPENDENCIES.rust.tsv | 2 +-
deny.toml | 7 +++++++
4 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3aec63d..635380f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,6 +65,9 @@ jobs:
- name: Check dependency licenses (Apache-compatible)
run: cargo deny --locked check licenses
+ - name: Check Rust security advisories
+ run: cargo deny --locked check advisories
+
- name: Verify Rust dependency metadata
run: |
cargo deny --locked list -f tsv -t 0.6 > /tmp/DEPENDENCIES.rust.tsv
diff --git a/Cargo.lock b/Cargo.lock
index 040ef91..36bceb3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -210,9 +210,9 @@ dependencies = [
[[package]]
name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
dependencies = [
"crossbeam-utils",
]
diff --git a/DEPENDENCIES.rust.tsv b/DEPENDENCIES.rust.tsv
index 3fd9454..f4458ee 100644
--- a/DEPENDENCIES.rust.tsv
+++ b/DEPENDENCIES.rust.tsv
@@ -23,7 +23,7 @@ [email protected] X
[email protected] X X
[email protected] X X
[email protected] X X
[email protected] X X
[email protected] X X
[email protected] X X
[email protected] X
[email protected] X
diff --git a/deny.toml b/deny.toml
index 2e37fb4..5860757 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,3 +29,10 @@ allow = [
# crates (adler32, foldhash). Zlib is ASF Category A (permissive).
"Zlib",
]
+
+[advisories]
+# This is an unmaintained build-time proc-macro dependency pulled in by
+# tantivy-jieba -> jieba-rs -> include-flate. It has no known vulnerability and
+# no patched release. Keep the exception narrow so every new vulnerability
+# advisory fails CI.
+ignore = ["RUSTSEC-2026-0173"]
