seungpyoson commented on issue #870: URL: https://github.com/apache/arrow-rs-object-store/issues/870#issuecomment-6539345226
Not automatically from the dependency version number alone. There is a narrower patch-release precedent: object_store [0.14.0](https://github.com/apache/arrow-rs-object-store/blob/v0.14.0/Cargo.toml) used quick-xml 0.40.1, and [0.14.1](https://github.com/apache/arrow-rs-object-store/blob/v0.14.1/Cargo.toml) moved to 0.41.0. The proposed 0.13 update starts at quick-xml 0.39, so it crosses additional behavior changes. Relative to that precedent, 0.13 additionally crosses quick-xml 0.40.0's XML 1.0 line-ending normalization fix. The reported probe found U+0085/U+2028 keys failed path validation on 0.39.4 but were preserved and accepted on 0.41.0. That is consistent with the normalization fix, but the probe did not isolate the intermediate versions. The rejection of more than 256 namespace declarations is the security fix introduced in 0.41.0; object_store's 0.14.1 patch already included it. Whether those differences fit the project's 0.13 maintenance policy is the decision I'm asking about. Neither unchanged object_store declarations nor the narrower 0.14 precedent establishes 0.13 patch compatibility. The failed and unrun checks listed in the issue also remain open in this assessment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
