Phoenix500526 opened a new pull request, #27420: URL: https://github.com/apache/datafusion/pull/27420
## Which issue does this PR close? None. Related to #27407. ## Rationale for this change `cargo audit` fails on the locked QUIC dependencies and also reports an unsound `rustix` release and a yanked `clipboard-win` release. The QUIC updates overlap with #27407. This PR additionally addresses the `rustix` and `clipboard-win` findings, collecting the four compatible dependency updates in one lockfile-only change. The two unmaintained warnings for `astral-tokio-tar` and `unsafe-libyaml` remain visible; no advisories are ignored. ## What changes are included in this PR? | Dependency | Before | After | | --- | --- | --- | | `quinn-proto` | 0.11.18 | 0.11.19 | | `quinn-udp` | 0.5.14 | 0.5.16 | | `rustix` | 1.1.4 | 1.1.6 | | `clipboard-win` | 5.4.1 | 5.4.3 | Only package versions and checksums in `Cargo.lock` change. Existing dependency relationships and `Cargo.toml` constraints are preserved. ## What is the testing strategy for this PR? The existing security audit CI job covers this change. Locally: - `bash ci/scripts/security_audit.sh` passes with only the two unmaintained warnings. - `cargo fmt --all` passes. - Both Clippy configurations in `ci/scripts/rust_clippy.sh` pass, including `cargo clippy --all-targets --workspace --all-features -- -D warnings`. - Verified the four checksums against the registry and confirmed the selected releases are not yanked. The complete local lint and extended test suites have not completed. No new tests are added because this updates dependency versions without changing DataFusion source code. ## Are there any user-facing changes? Dependency security fixes only; no DataFusion API or configuration changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
