dhruvarya-db opened a new pull request, #3496: URL: https://github.com/apache/iceberg-rust/pull/3496
## Which issue does this PR close? N/A. `security_audit` started failing on `main` and on open PRs after RustSec published three advisories for the distrusted emSign certificates (CVE-2026-111943). ## What changes are included in this PR? Updates `rustls-webpki` to 0.103.16 and `webpki-roots` / `webpki-root-certs` to 1.0.10, which addresses RUSTSEC-2026-0382, RUSTSEC-2026-0383, and RUSTSEC-2026-0381 for `webpki-roots` 1.x. `sqlx-core` 0.8.6 still pulls in `webpki-roots` 0.26.11. That is the final 0.26.x release and only re-exports `webpki-roots` 1.x, which now resolves to the fixed 1.0.10. `cargo audit` still flags it by version number, so this PR adds RUSTSEC-2026-0381 to `.cargo/audit.toml` with a note to remove it once sqlx depends on `webpki-roots` 1.x directly. Upgrading to sqlx 0.9 would avoid the ignore, but it is a breaking upgrade for the SQL catalog and is out of scope here. ## Are these changes tested? Validated with `cargo audit` (no findings), `cargo metadata --locked --format-version 1`, and `cargo check --workspace --all-targets --locked`. ## AI Disclosure Written with Claude Opus 5.5 and reviewed by me. Worth a reviewer's check: whether ignoring RUSTSEC-2026-0381 is acceptable, given that the ignore also covers `webpki-roots` 1.x if the lockfile ever drops back below 1.0.10. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
