viirya opened a new pull request, #54:
URL: https://github.com/apache/spark-connect-gateway/pull/54
### What changes were proposed in this pull request?
Update three crates in `Cargo.lock`. Lockfile-only; no `Cargo.toml` change.
```
cargo update -p webpki-roots --precise 1.0.10
cargo update -p rustls-webpki --precise 0.103.16
cargo update -p tokio --precise 1.53.3
```
The resolved set is **431 crates before and after**, and these three are the
only versions that change. The diff also re-points four dependents from
`windows-sys` 0.61.2 to 0.52.0. That is not a downgrade: both versions are in
the graph before and after, and they are Windows-only.
### Why are the changes needed?
The scheduled `cargo audit` run on `main` has failed daily since it was
enabled in SPARK-60370 (#52). Two of its findings, plus one warning, have
fixed releases:
| Advisory | Crate | Issue |
|---|---|---|
| RUSTSEC-2026-0381 | `webpki-roots` 1.0.9 -> 1.0.10 | Bundled root
certificates allow trust in distrusted emSign intermediates |
| RUSTSEC-2026-0382 | `rustls-webpki` 0.103.14 -> 0.103.16 | Certificate
verification may accept distrusted intermediates |
| RUSTSEC-2026-0386 (warning: unsound) | `tokio` 1.53.1 -> 1.53.3 |
`AsyncFd::new` and related constructors violate I/O safety |
The two webpki advisories affect the gateway: both crates are compiled into
it
and sit on the outbound TLS certificate-verification path (`kube-client` for
the
K8s API, `reqwest` for OIDC JWKS, tonic / `opentelemetry-otlp`).
**Not addressed here:** RUSTSEC-2026-0387 (`crypto-bigint` 0.5.5, timing
variability in operations intended to be constant-time), the scheduled run's
remaining failure. The fix is in `crypto-bigint` 0.7.6, which nothing in the
current dependency graph can use; jsonwebtoken 11 (#39) still resolves 0.5.5.
It will be handled separately.
### Does this PR introduce _any_ user-facing change?
No. No configuration or API change.
### How was this patch tested?
On the pinned 1.99.0 toolchain:
- `cargo audit` reports **1 vulnerability (crypto-bigint) instead of 3**, and
no longer warns about `tokio`.
- `cargo clippy --workspace --all-targets -- -D warnings` -- clean.
- `cargo fmt --all -- --check` -- clean.
- `cargo test --workspace` -- 204 passed, 0 failed, 10 ignored. `tokio` is
the
gateway's async runtime, so this exercises the new version.
- `dev/audit-new-advisories.sh` against `main`'s `Cargo.lock` (what this PR's
`cargo audit` check runs) exits 0, listing the two webpki advisories as
resolved and `crypto-bigint` as already present.
- Licenses are unchanged and all Category A: `rustls-webpki` ISC, `tokio`
MIT,
`webpki-roots` CDLA-Permissive-2.0 (Category A per LEGAL-732).
- The lockfile claim was checked by comparing the full resolved package set
(name + version for all 431 entries) against `main`.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
