L. C. Hsieh created SPARK-60852:
-----------------------------------
Summary: Update pulldown-cmark in Cargo.lock to pick up recent
RustSec advisories
Key: SPARK-60852
URL: https://issues.apache.org/jira/browse/SPARK-60852
Project: Spark
Issue Type: Sub-task
Components: Connect
Affects Versions: connect-gateway-0.1.0
Reporter: L. C. Hsieh
Assignee: L. C. Hsieh
The scheduled cargo audit run on main has failed every day since 2026-10-29
because of two advisories against pulldown-cmark 0.13.4:
- RUSTSEC-2026-0414: exponential event growth with ENABLE_WIKILINKS (fixed in
0.13.5)
- RUSTSEC-2026-0433: quadratic parsing of nested image wikilinks with
ENABLE_WIKILINKS (fixed in 0.13.6)
pulldown-cmark is a build-time dependency only: scg-genproto's build script uses
tonic-prost-build, whose prost-build parses the markdown in .proto comments with
Options::all(), which includes ENABLE_WIKILINKS. The input is the vendored
.proto files in this repository, so the exposure is limited to build time on
trusted input, and the crate is not linked into the gateway binary.
prost-build requires pulldown-cmark ^0.13, so the fix is a Cargo.lock-only
update to 0.13.6. Its dependencies and features are identical to 0.13.4, so no
other lockfile entries change.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
