alamb opened a new pull request, #27407: URL: https://github.com/apache/datafusion/pull/27407
## Which issue does this PR close? - Related to #27388, where the security audit is failing. ## Rationale for this change `cargo audit` fails against the current `Cargo.lock` on `main` with 3 vulnerabilities from advisories published after the last audit run: - `quinn-proto` 0.11.18: [RUSTSEC-2026-0523](https://rustsec.org/advisories/RUSTSEC-2026-0523), [RUSTSEC-2026-0524](https://rustsec.org/advisories/RUSTSEC-2026-0524) - `quinn-udp` 0.5.14: [RUSTSEC-2026-0538](https://rustsec.org/advisories/RUSTSEC-2026-0538) The same advisories are failing the `security_audit` check on `branch-54` and `branch-55`. ## What changes are included in this PR? `Cargo.lock` only, from ```shell cargo update -p quinn-udp -p quinn-proto ``` | Crate | Before | After | | ------------- | ------- | ------- | | `quinn-proto` | 0.11.18 | 0.11.19 | | `quinn-udp` | 0.5.14 | 0.5.16 | Both updates are semver compatible, so no `Cargo.toml` changes are needed, and no new advisories are ignored. ## What is the testing strategy for this PR? Covered by the `security_audit` CI job. Locally, `cargo audit` now passes with only allowed warnings remaining. ## Are there any user-facing changes? No, dependency version bumps in `Cargo.lock` only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
