You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "alamb (via GitHub)" <gi...@apache.org> on 2026/04/28 20:35:38 UTC
[I] security_audit is failing on main [datafusion]
alamb opened a new issue, #21901:
URL: https://github.com/apache/datafusion/issues/21901
### Describe the bug
Its my favorite time of the day -- CI fails due to external change (new RUSTSEC!)
cargo audit is failing on main
### To Reproduce
https://github.com/apache/datafusion/actions/runs/25074402581/job/73463055541
```
Crate: astral-tokio-tar
Version: 0.6.0
Title: PAX Header Desynchronization in astral-tokio-tar
Date: 2026-04-27
ID: RUSTSEC-2026-0112
URL: https://rustsec.org/advisories/RUSTSEC-2026-0112
Solution: Upgrade to >=0.6.1
Dependency tree:
astral-tokio-tar 0.6.0
└── testcontainers 0.27.3
└── testcontainers-modules 0.15.0
├── datafusion-sqllogictest 53.1.0
└── datafusion-cli 53.1.0
error: 2 vulnerabilities found!
warning: 1 allowed warning found
Crate: astral-tokio-tar
Version: 0.6.0
Title: `unpack_in` can chmod arbitrary directories by following symlinks
Date: 2026-04-27
ID: RUSTSEC-2026-0113
URL: https://rustsec.org/advisories/RUSTSEC-2026-0113
Solution: Upgrade to >=0.6.1
```
### Expected behavior
_No response_
### Additional context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] security_audit is failing on main [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #21901:
URL: https://github.com/apache/datafusion/issues/21901#issuecomment-4338881251
Proposed fix:
- https://github.com/apache/datafusion/pull/21902
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] security_audit is failing on main [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #21901:
URL: https://github.com/apache/datafusion/issues/21901#issuecomment-4338878158
Seems the new RUSTSEC is
https://rustsec.org/advisories/RUSTSEC-2026-0112
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] security_audit is failing on main [datafusion]
Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey closed issue #21901: security_audit is failing on main
URL: https://github.com/apache/datafusion/issues/21901
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org