[PR] [57_maintenance] chore: update tokio to 1.54.1 to fix cargo audit CI [arrow-rs]

["alamb (via GitHub)" <gi...@apache.org>]

alamb opened a new pull request, #11819:
URL: https://github.com/apache/arrow-rs/pull/11819

   # Which issue does this PR close?
   
   - N/A (fixes CI on the `57_maintenance` branch)
   
   # Rationale for this change
   
   The `Audit` job fails on pushes to `57_maintenance` (for example https://github.com/apache/arrow-rs/actions/runs/39737507626/job/119686585080) because an advisory was published against a version pinned in the committed `Cargo.lock`:
   
   - RUSTSEC-2026-0384: `tokio` 1.54.0 (race condition in `tokio::time::Interval`), fixed in 1.54.1. The 1.54.0 release has also been yanked.
   
   `main` (tokio 1.53.3) and `59_maintenance` (tokio 1.53.1) are not affected. `58_maintenance` pins the same 1.54.0 and gets the same fix in a separate PR.
   
   # What changes are included in this PR?
   
   Update only `tokio` in `Cargo.lock` from 1.54.0 to 1.54.1 (version and checksum). Running `cargo update -p tokio --precise 1.54.1` also re-unified the `windows-sys` dependency of five unrelated crates, so this PR applies just the `tokio` entry to keep the diff minimal.
   
   Verified locally that `cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195 --ignore RUSTSEC-2026-0176 --ignore RUSTSEC-2026-0177` (the CI invocation) passes with only the two already-allowed `unmaintained` warnings, and that the lockfile resolves with `cargo +1.85.0 metadata --locked`. tokio 1.54.1 has `rust-version = "1.85"`, matching the workspace MSRV.
   
   # Are these changes tested?
   
   CI
   
   # Are there any user-facing changes?
   
   No. This only affects the lockfile used for workspace builds and CI.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [57_maintenance] chore: update tokio to 1.54.1 to fix cargo audit CI [arrow-rs]

["alamb (via GitHub)" <gi...@apache.org>]

alamb merged PR #11819:
URL: https://github.com/apache/arrow-rs/pull/11819


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org