alamb opened a new pull request, #11794: URL: https://github.com/apache/arrow-rs/pull/11794
# Which issue does this PR close? - Part of #11665 (58.4.1 release) # Rationale for this change The `Audit` job fails on `58_maintenance` because two advisories were published against versions pinned in the committed `Cargo.lock`: - RUSTSEC-2026-0382: `rustls-webpki` 0.103.15 (fixed in 0.103.16) - RUSTSEC-2026-0381: `webpki-roots` 1.0.9 (fixed in 1.0.10) Reproduced locally by running the CI `cargo audit` invocation (with the workflow's `--ignore` list) against the branch, which reports exactly these two vulnerabilities. This is the same fix as #11752 on `main` and #11793 on `59_maintenance`. # What changes are included in this PR? Update only the two flagged crates in `Cargo.lock`: ``` cargo update -p rustls-webpki -p webpki-roots ``` Verified locally that the CI `cargo audit` invocation passes afterwards, and that the lockfile resolves with `cargo +1.85.0 metadata --locked`. Both new versions have `rust-version = "1.71"`, below the workspace MSRV of 1.85. # Are these changes tested? CI # Are there any user-facing changes? No. This only affects the lockfile used for workspace builds and CI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
