You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by sc...@apache.org on 2026/04/15 17:30:25 UTC
(iceberg-rust) branch main updated: Fix RUSTSEC-2026-0097 (#2331)
This is an automated email from the ASF dual-hosted git repository.
schang pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
The following commit(s) were added to refs/heads/main by this push:
new 3fe7be196 Fix RUSTSEC-2026-0097 (#2331)
3fe7be196 is described below
commit 3fe7be196cae9e119747de3bc3fcae5818e2e9b0
Author: blackmwk <li...@outlook.com>
AuthorDate: Thu Apr 16 01:30:19 2026 +0800
Fix RUSTSEC-2026-0097 (#2331)
## Which issue does this PR close?
- Closes #2327 #2328 #2329
## What changes are included in this PR?
Upgrade rnd version, use recommended api.
## Are these changes tested?
ut.
---
.cargo/audit.toml | 5 ++
Cargo.lock | 57 +++++++++++-----------
Cargo.toml | 2 +-
.../src/expr/visitors/page_index_evaluator.rs | 6 +--
.../expr/visitors/row_group_metrics_evaluator.rs | 6 +--
.../src/writer/file_writer/rolling_writer.rs | 2 +-
6 files changed, 41 insertions(+), 37 deletions(-)
diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 09e2d35c5..71354ea3a 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -33,4 +33,9 @@ ignore = [
#
# Introduced by object_store, see https://github.com/apache/arrow-rs-object-store/issues/564
"RUSTSEC-2025-0134",
+ # `rand` unsoundness with custom logger using `rand::rng()`
+ #
+ # Direct dependency upgraded to 0.9.3+. Transitive rand 0.8.5 remains
+ # from reqsign/sqllogictest/rustc-hash — no 0.8.x patch exists.
+ "RUSTSEC-2026-0097",
]
diff --git a/Cargo.lock b/Cargo.lock
index 73a3f311b..297b566f4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -193,7 +193,7 @@ dependencies = [
"miniz_oxide",
"num-bigint",
"quad-rand",
- "rand 0.9.2",
+ "rand 0.9.4",
"regex-lite",
"serde",
"serde_bytes",
@@ -1310,7 +1310,7 @@ version = "3.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
]
[[package]]
@@ -1673,7 +1673,7 @@ dependencies = [
"object_store",
"parking_lot",
"parquet",
- "rand 0.9.2",
+ "rand 0.9.4",
"regex",
"sqlparser",
"tempfile",
@@ -1825,7 +1825,7 @@ dependencies = [
"liblzma",
"log",
"object_store",
- "rand 0.9.2",
+ "rand 0.9.4",
"tokio",
"tokio-util",
"url",
@@ -1978,7 +1978,7 @@ dependencies = [
"object_store",
"parking_lot",
"parquet",
- "rand 0.9.2",
+ "rand 0.9.4",
"tempfile",
"url",
]
@@ -2044,7 +2044,7 @@ dependencies = [
"md-5",
"memchr",
"num-traits",
- "rand 0.9.2",
+ "rand 0.9.4",
"regex",
"sha2",
"unicode-segmentation",
@@ -2344,7 +2344,7 @@ dependencies = [
"datafusion-functions-nested",
"log",
"percent-encoding",
- "rand 0.9.2",
+ "rand 0.9.4",
"serde_json",
"sha1",
"sha2",
@@ -2657,7 +2657,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
]
[[package]]
@@ -2752,7 +2752,7 @@ checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
dependencies = [
"cfg-if",
"rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
]
[[package]]
@@ -3287,7 +3287,7 @@ dependencies = [
"libc",
"percent-encoding",
"pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.3",
"tokio",
"tower-service",
"tracing",
@@ -3356,7 +3356,7 @@ dependencies = [
"ordered-float 4.6.0",
"parquet",
"pretty_assertions",
- "rand 0.8.5",
+ "rand 0.9.4",
"regex",
"reqwest",
"roaring",
@@ -3852,7 +3852,7 @@ dependencies = [
"portable-atomic",
"portable-atomic-util",
"serde_core",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
]
[[package]]
@@ -4257,7 +4257,7 @@ dependencies = [
"hyper-util",
"log",
"pin-project-lite",
- "rand 0.9.2",
+ "rand 0.9.4",
"regex",
"serde_json",
"serde_urlencoded",
@@ -4515,7 +4515,7 @@ dependencies = [
"parking_lot",
"percent-encoding",
"quick-xml 0.39.2",
- "rand 0.10.0",
+ "rand 0.10.1",
"reqwest",
"ring",
"rustls-pki-types",
@@ -5155,7 +5155,7 @@ dependencies = [
"quinn-udp",
"rustc-hash",
"rustls",
- "socket2 0.5.10",
+ "socket2 0.6.3",
"thiserror 2.0.18",
"tokio",
"tracing",
@@ -5171,7 +5171,7 @@ dependencies = [
"bytes",
"getrandom 0.3.4",
"lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
"ring",
"rustc-hash",
"rustls",
@@ -5192,9 +5192,9 @@ dependencies = [
"cfg_aliases",
"libc",
"once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.3",
"tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
]
[[package]]
@@ -5251,9 +5251,9 @@ dependencies = [
[[package]]
name = "rand"
-version = "0.9.2"
+version = "0.9.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
dependencies = [
"rand_chacha 0.9.0",
"rand_core 0.9.5",
@@ -5261,9 +5261,9 @@ dependencies = [
[[package]]
name = "rand"
-version = "0.10.0"
+version = "0.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
dependencies = [
"chacha20",
"getrandom 0.4.2",
@@ -5657,7 +5657,7 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
]
[[package]]
@@ -5699,9 +5699,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
-version = "0.103.10"
+version = "0.103.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06"
dependencies = [
"aws-lc-rs",
"ring",
@@ -6476,7 +6476,6 @@ dependencies = [
"cfg-if",
"libc",
"psm",
- "windows-sys 0.52.0",
"windows-sys 0.59.0",
]
@@ -6606,7 +6605,7 @@ dependencies = [
"getrandom 0.4.2",
"once_cell",
"rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
]
[[package]]
@@ -7248,7 +7247,7 @@ dependencies = [
"nix 0.29.0",
"once_cell",
"pin-project",
- "rand 0.9.2",
+ "rand 0.9.4",
"socket2 0.5.10",
"thiserror 2.0.18",
"tokio",
@@ -7502,7 +7501,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
]
[[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 778e69c9d..2f5a515ef 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -108,7 +108,7 @@ ordered-float = "4"
parquet = "58"
pilota = "0.11.10"
pretty_assertions = "1.4"
-rand = "0.8.5"
+rand = "0.9.3"
regex = "1.11.3"
reqwest = { version = "0.12.12", default-features = false, features = ["json"] }
roaring = { version = "0.11" }
diff --git a/crates/iceberg/src/expr/visitors/page_index_evaluator.rs b/crates/iceberg/src/expr/visitors/page_index_evaluator.rs
index 96d1c651c..4cd676dab 100644
--- a/crates/iceberg/src/expr/visitors/page_index_evaluator.rs
+++ b/crates/iceberg/src/expr/visitors/page_index_evaluator.rs
@@ -793,7 +793,7 @@ mod tests {
};
use parquet::file::metadata::{PageIndexPolicy, ParquetMetaData};
use parquet::file::properties::WriterProperties;
- use rand::{Rng, thread_rng};
+ use rand::Rng;
use tempfile::NamedTempFile;
use super::PageIndexEvaluator;
@@ -1284,13 +1284,13 @@ mod tests {
#[test]
fn eval_in_length_of_set_above_limit_all_rows() -> Result<()> {
- let mut rng = thread_rng();
+ let mut rng = rand::rng();
let (metadata, _temp_file) = create_test_parquet_file()?;
let (column_index, offset_index, row_group_metadata) = get_test_metadata(&metadata);
let (iceberg_schema_ref, field_id_map) = build_iceberg_schema_and_field_map()?;
let filter = Reference::new("col_float")
- .is_in(std::iter::repeat_with(|| Datum::float(rng.gen_range(0.0..10.0))).take(1000))
+ .is_in(std::iter::repeat_with(|| Datum::float(rng.random_range(0.0..10.0))).take(1000))
.bind(iceberg_schema_ref.clone(), false)?;
let result = PageIndexEvaluator::eval(
diff --git a/crates/iceberg/src/expr/visitors/row_group_metrics_evaluator.rs b/crates/iceberg/src/expr/visitors/row_group_metrics_evaluator.rs
index 0506b33af..ad7e19f54 100644
--- a/crates/iceberg/src/expr/visitors/row_group_metrics_evaluator.rs
+++ b/crates/iceberg/src/expr/visitors/row_group_metrics_evaluator.rs
@@ -528,7 +528,7 @@ mod tests {
use parquet::schema::types::{
ColumnDescriptor, ColumnPath, SchemaDescriptor, Type as parquetSchemaType,
};
- use rand::{Rng, thread_rng};
+ use rand::Rng;
use super::RowGroupMetricsEvaluator;
use crate::Result;
@@ -1617,7 +1617,7 @@ mod tests {
#[test]
fn eval_true_for_too_many_literals_filter_is_in() -> Result<()> {
- let mut rng = thread_rng();
+ let mut rng = rand::rng();
let row_group_metadata = create_row_group_metadata(
1,
@@ -1636,7 +1636,7 @@ mod tests {
let (iceberg_schema_ref, field_id_map) = build_iceberg_schema_and_field_map()?;
let filter = Reference::new("col_float")
- .is_in(std::iter::repeat_with(|| Datum::float(rng.gen_range(0.0..10.0))).take(1000))
+ .is_in(std::iter::repeat_with(|| Datum::float(rng.random_range(0.0..10.0))).take(1000))
.bind(iceberg_schema_ref.clone(), false)?;
let result = RowGroupMetricsEvaluator::eval(
diff --git a/crates/iceberg/src/writer/file_writer/rolling_writer.rs b/crates/iceberg/src/writer/file_writer/rolling_writer.rs
index b86f6a2ea..b0b2d2f19 100644
--- a/crates/iceberg/src/writer/file_writer/rolling_writer.rs
+++ b/crates/iceberg/src/writer/file_writer/rolling_writer.rs
@@ -399,7 +399,7 @@ mod tests {
"Kelly", "Larry", "Mallory", "Shawn",
];
- let mut rng = rand::thread_rng();
+ let mut rng = rand::rng();
let batch_num = 10;
let batch_rows = 100;
let expected_rows = batch_num * batch_rows;