You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "viirya (via GitHub)" <gi...@apache.org> on 2026/10/10 02:16:49 UTC
[PR] [SPARK-60115] Pin the transitive h2 dependency to 0.4.16 to pick up RUSTSEC-2026-0258 [spark-connect-gateway]
viirya opened a new pull request, #48:
URL: https://github.com/apache/spark-connect-gateway/pull/48
### What changes were proposed in this pull request?
Pin the transitive `h2` dependency to 0.4.16 to pick up the fix for
RUSTSEC-2026-0258.
`h2` is not a direct dependency -- it appears nowhere in `Cargo.toml`, arriving
via `hyper` and `tonic` 0.14.6 -- so this is a lockfile-only change:
```
cargo update -p h2 --precise 0.4.16
```
The resolved package set is **431 crates before and after**, and `h2 0.4.15 ->
0.4.16` is the only version that moves.
The diff also shows four `windows-sys 0.61.2 -> 0.52.0` lines inside other
packages' dependency lists. **These are not a downgrade.** Both 0.52.0 and
0.61.2 are present in the graph before and after this change; cargo only
re-pointed some dependents at the copy that was already there. They are
Windows-only crates and CI is `ubuntu-latest` throughout, so they affect no
build here.
### Why are the changes needed?
`cargo audit` against `main` (131c830) reports three advisories. This addresses
the one that is both server-side and has a fix available:
```
RUSTSEC-2026-0258 -- h2 unbounded empty DATA frames
https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
affected: h2 0.4.15, patched: >= 0.4.16
```
`h2` reaches the gateway through `hyper` -> `tonic` 0.14.6, and the tonic server
*is* the gateway's own client-facing listener on `:15003`. A peer that can open
a connection and send unbounded empty DATA frames is the threat model of a
cluster- or internet-facing gRPC proxy, not a hypothetical.
#### Scope: what this does not fix
The other two advisories are deliberately left out of this change.
- **RUSTSEC-2026-0285** -- `rustls` 0.23.43, "TLS 1.3 handshake messages
incorrectly accepted across encryption level boundaries", 5.3 medium. Patched
in 0.23.45 and already proposed by dependabot in #47, so it belongs there
rather than here. Worth noting the gateway's exposure is limited: it does not
terminate TLS (no `ServerConfig` / `TlsAcceptor` / `ServerTlsConfig` anywhere
under `crates/`, and `:15003` is plaintext), and pulls `rustls` only on client
paths -- `kube-client` for the K8s API, `reqwest` for OIDC JWKS, and
`opentelemetry-otlp`'s `tls-ring`.
- **RUSTSEC-2023-0071** -- `rsa` 0.9.10, Marvin Attack timing sidechannel, 5.9
medium. No fixed version exists, so there is nothing to bump to. It arrives
via `jsonwebtoken`'s RSA backend under the `rust_crypto` provider selected in
SPARK-59552, and needs a decision -- accept the risk, or change backend --
rather than a version bump. Possibly worth resolving alongside #39.
#### A limitation of this fix
A `--precise` pin on a transitive dependency is not durable: the next
`cargo update`, or a dependabot bump of `hyper` or `tonic`, can re-resolve `h2`
and silently drop back below 0.4.16.
The durable fix is running `cargo audit` in CI, which is **not wired up today**
-- all three advisories reached `main` unnoticed and were found only by running
it by hand. That is worth its own change, and this PR does not attempt it.
### Does this PR introduce _any_ user-facing change?
No. No configuration, API, or behavioural change; the only effect is that the
HTTP/2 implementation underneath the gRPC server no longer accepts an unbounded
stream of empty DATA frames.
### How was this patch tested?
On the pinned 1.99.0 toolchain:
- `cargo audit` now reports **2 vulnerabilities instead of 3**, with
RUSTSEC-2026-0258 gone and the `rustls` and `rsa` findings unchanged.
- `cargo clippy --workspace --all-targets -- -D warnings` -- clean.
- `cargo fmt --all -- --check` -- clean.
- `cargo test --workspace` -- **204 passed, 0 failed, 10 ignored**, matching the
baseline on `main`.
The lockfile claim was verified by comparing the full resolved package set
(name + version for all 431 entries) before and after, rather than by reading
the diff -- `cargo update --dry-run` had reported only the `h2` line and did not
mention the `windows-sys` re-pointing.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-60115] Pin the transitive h2 dependency to 0.4.16 to pick up RUSTSEC-2026-0258 [spark-connect-gateway]
Posted by "viirya (via GitHub)" <gi...@apache.org>.
viirya commented on PR #48:
URL: https://github.com/apache/spark-connect-gateway/pull/48#issuecomment-6138824988
Thanks @dongjoon-hyun !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-60115] Pin the transitive h2 dependency to 0.4.16 to pick up RUSTSEC-2026-0258 [spark-connect-gateway]
Posted by "viirya (via GitHub)" <gi...@apache.org>.
viirya closed pull request #48: [SPARK-60115] Pin the transitive h2 dependency to 0.4.16 to pick up RUSTSEC-2026-0258
URL: https://github.com/apache/spark-connect-gateway/pull/48
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org