(paimon-full-text) 01/03: Check Rust advisories and update crossbeam-epoch (#18)

[ho...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

XiaoHongbo-Hope pushed a commit to branch release-0.1.0
in repository https://gitbox.apache.org/repos/asf/paimon-full-text.git

commit 23820d27d498e27db7a32b14049ea805291cd53c
Author: jianguotian <84...@qq.com>
AuthorDate: Fri Jul 17 18:23:05 2026 +0800

    Check Rust advisories and update crossbeam-epoch (#18)
    
    Enable cargo-deny advisory checks, update crossbeam-epoch to 0.9.20, and narrowly ignore the unmaintained include-flate proc-macro advisory which has no patched release.
    
    Co-authored-by: mingfeng <tj...@antgroup.com>
---
 .github/workflows/ci.yml | 3 +++
 Cargo.lock               | 4 ++--
 DEPENDENCIES.rust.tsv    | 2 +-
 deny.toml                | 7 +++++++
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3aec63d..635380f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,6 +65,9 @@ jobs:
       - name: Check dependency licenses (Apache-compatible)
         run: cargo deny --locked check licenses
 
+      - name: Check Rust security advisories
+        run: cargo deny --locked check advisories
+
       - name: Verify Rust dependency metadata
         run: |
           cargo deny --locked list -f tsv -t 0.6 > /tmp/DEPENDENCIES.rust.tsv
diff --git a/Cargo.lock b/Cargo.lock
index 040ef91..36bceb3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -210,9 +210,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
diff --git a/DEPENDENCIES.rust.tsv b/DEPENDENCIES.rust.tsv
index 3fd9454..f4458ee 100644
--- a/DEPENDENCIES.rust.tsv
+++ b/DEPENDENCIES.rust.tsv
@@ -23,7 +23,7 @@ combine@4.6.7						X
 crc32fast@1.5.0	X					X					
 crossbeam-channel@0.5.15	X					X					
 crossbeam-deque@0.8.6	X					X					
-crossbeam-epoch@0.9.18	X					X					
+crossbeam-epoch@0.9.20	X					X					
 crossbeam-utils@0.8.21	X					X					
 crunchy@0.2.4						X					
 darling@0.23.0						X					
diff --git a/deny.toml b/deny.toml
index 2e37fb4..5860757 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,3 +29,10 @@ allow = [
     # crates (adler32, foldhash). Zlib is ASF Category A (permissive).
     "Zlib",
 ]
+
+[advisories]
+# This is an unmaintained build-time proc-macro dependency pulled in by
+# tantivy-jieba -> jieba-rs -> include-flate. It has no known vulnerability and
+# no patched release. Keep the exception narrow so every new vulnerability
+# advisory fails CI.
+ignore = ["RUSTSEC-2026-0173"]