You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "alamb (via GitHub)" <gi...@apache.org> on 2026/09/19 20:24:58 UTC
[PR] [branch-55] fix: update rustls to address RUSTSEC-2026-0285 (#25309) [datafusion]
alamb opened a new pull request, #25514:
URL: https://github.com/apache/datafusion/pull/25514
- Fixes the `security_audit` failure on `branch-55` (for example https://github.com/apache/datafusion/actions/runs/35435408307/job/105877099456 on https://github.com/apache/datafusion/pull/25277)
This PR:
- Backports https://github.com/apache/datafusion/pull/25309 from @Xuanwo to the branch-55 line
## Rationale
`branch-55` locks `rustls` 0.23.39, which is affected by [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html) ("TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries", published 2026-09-14). Every PR targeting `branch-55` now fails the `security_audit` job until the lockfile is updated. `rustls` 0.23.45 fixes the vulnerability.
The cherry-pick applied cleanly: `branch-55` and `main` had identical `rustls`, `aws-lc-rs`, `aws-lc-sys`, and `rustls-webpki` entries before the fix.
## Testing
`cargo audit` with the same ignores as the CI job passes on this branch (it fails on `branch-55` without this change):
```sh
cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
```
`cargo fetch --locked` and `cargo check --locked -p datafusion-cli` also succeed, confirming the updated lockfile resolves and builds.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] [branch-55] fix: update rustls to address RUSTSEC-2026-0285 (#25309) [datafusion]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #25514:
URL: https://github.com/apache/datafusion/pull/25514#issuecomment-5745199881
## [Codecov](https://app.codecov.io/gh/apache/datafusion/pull/25514?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 81.21%. Comparing base ([`180db4c`](https://app.codecov.io/gh/apache/datafusion/commit/180db4c1dde0d891b8d5a3ac3a836d4e7ba5992d?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`a27286f`](https://app.codecov.io/gh/apache/datafusion/commit/a27286f33443669d94023f74dcb99db66b26bfdf?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## branch-55 #25514 +/- ##
=============================================
- Coverage 81.21% 81.21% -0.01%
=============================================
Files 1110 1110
Lines 388499 388499
Branches 388499 388499
=============================================
- Hits 315513 315510 -3
- Misses 54436 54437 +1
- Partials 18550 18552 +2
```
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/datafusion/pull/25514?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] [branch-55] fix: update rustls to address RUSTSEC-2026-0285 (#25309) [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb merged PR #25514:
URL: https://github.com/apache/datafusion/pull/25514
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] [branch-55] fix: update rustls to address RUSTSEC-2026-0285 (#25309) [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #25514:
URL: https://github.com/apache/datafusion/pull/25514#issuecomment-5745321518
Thanks @AdamGS
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org