Copilot commented on code in PR #3538: URL: https://github.com/apache/iceberg-rust/pull/3538#discussion_r4379273965
########## .cargo/audit.toml: ########## @@ -32,4 +32,15 @@ ignore = [ # 1.0.10, but cargo-audit flags it by version number. Remove once sqlx moves # to webpki-roots 1.x directly. "RUSTSEC-2026-0381", + # `zstd` < 0.14.3 / `zstd-safe` < 8.2.0 memory-safety fixes. + # + # The fixes are only in zstd 0.14 / zstd-safe 8, but the latest + # apache-avro (0.22) and parquet 59.x still require zstd ^0.13. The affected + # paths are not reachable here: nothing calls `with_context` + # (RUSTSEC-2026-0391), and the `seekable` (RUSTSEC-2026-0398) and `legacy` + # (RUSTSEC-2026-0403) features are disabled. Remove once apache-avro and + # parquet move to zstd 0.14. + "RUSTSEC-2026-0391", + "RUSTSEC-2026-0398", + "RUSTSEC-2026-0403", Review Comment: These are memory-safety advisories, and the justification relies on specific call paths/features being unreachable. Please strengthen the documentation to make this auditable over time: (1) explicitly state whether `zstd` input is treated as trusted/untrusted in this workspace (e.g., whether you ever decode attacker-controlled parquet/avro), and (2) add a concrete verification breadcrumb (e.g., the exact `cargo tree -e features -i zstd` / grep evidence used to confirm `seekable`/`legacy` aren’t enabled and `with_context` isn’t referenced). This reduces the risk that a future dependency change makes the ignored advisories reachable while CI continues to pass. ########## .cargo/audit.toml: ########## @@ -32,4 +32,15 @@ ignore = [ # 1.0.10, but cargo-audit flags it by version number. Remove once sqlx moves # to webpki-roots 1.x directly. "RUSTSEC-2026-0381", + # `zstd` < 0.14.3 / `zstd-safe` < 8.2.0 memory-safety fixes. + # + # The fixes are only in zstd 0.14 / zstd-safe 8, but the latest + # apache-avro (0.22) and parquet 59.x still require zstd ^0.13. The affected + # paths are not reachable here: nothing calls `with_context` + # (RUSTSEC-2026-0391), and the `seekable` (RUSTSEC-2026-0398) and `legacy` + # (RUSTSEC-2026-0403) features are disabled. Remove once apache-avro and + # parquet move to zstd 0.14. Review Comment: The removal condition is currently vague. To make this actionable, consider naming the minimum upstream versions (or linking to an upstream issue/PR) that adopt `zstd` 0.14 / `zstd-safe` 8, so it’s clear when the ignores can be deleted without re-investigation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
