jmqd opened a new issue, #722: URL: https://github.com/apache/avro-rs/issues/722
Thanks for all the work on avro-rs! Do you think pushing up an expedited 0.23 release would be possible? 0.22.0 and other recent releases depend on zstd 0.13, which is flagged by [RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391), [RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398) and [RUSTSEC-2026-0403(https://rustsec.org/advisories/RUSTSEC-2026-0403). `main` already uses zstd 0.14.3 (#676, #711, #718) and also has several unreleased decode hardening fixes (#639, #640, #642, #643, #644). Downstream projects such as iceberg-rust can't clear these advisories until a release ships. We know releases take volunteer time and a vote, so no pressure. If it helps, we're glad to test and vote on an RC. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
