XiaoHongbo-Hope opened a new pull request, #1229: URL: https://github.com/apache/paimon-rust/pull/1229
## Summary - Upgrade compression-codecs to 0.4.46, moving async Zstd decoding onto zstd 0.14.3 / zstd-safe 8.2.0. - Upgrade zstd-sys to 2.1.2 to fix the wasm32 allocator advisory (RUSTSEC-2026-0410). - Regenerate dependency reports and document three API-specific advisory exceptions for transitive zstd 0.13 users. ## Security scope - RUSTSEC-2026-0391: the affected raw Encoder/Decoder::with_context constructors are not called by the remaining old-zstd users. - RUSTSEC-2026-0398: the affected seekable feature is disabled. - RUSTSEC-2026-0403: the raw streaming decoder in compression-codecs now uses patched zstd-safe 8.2; remaining old-zstd decompression uses the unaffected read/bulk paths. This does not remove zstd 0.13 / zstd-safe 7 from the graph: Arrow, DataFusion, Parquet and several other upstream dependencies still require them. These exceptions need re-review as those dependencies move to zstd 0.14; target review by 2026-11-15. There is no blanket exception for RUSTSEC-2026-0410. ## Validation - cargo deny --locked --all-features check --warn unmaintained advisories licenses: passed - Python 3.11 dependency report generation and verification: passed - cargo +1.94.0 check -p paimon --no-default-features --features storage-fs --locked: passed - Targeted tests and release-license verification: running locally; GitHub CI pending. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
