You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "alamb (via GitHub)" <gi...@apache.org> on 2024/04/18 11:28:22 UTC
[PR] Alamb/prepare 37.1.0 [arrow-datafusion]
alamb opened a new pull request, #10128:
URL: https://github.com/apache/arrow-datafusion/pull/10128
NOTE this PR targets branch-37. Once it is merged I will create a PR with a cherry-pick to main to bring the changes there
## Which issue does this PR close?
<!--
We generally require a GitHub issue to be filed for all bug fixes and enhancements and this helps us generate change logs for our releases. You can link an issue to this PR using the GitHub syntax. For example `Closes #123` indicates that this PR will close issue #123.
-->
Part of https://github.com/apache/arrow-datafusion/issues/9904
## Rationale for this change
Patch release to fix regressions
## What changes are included in this PR?
- Update version to `37.1.0`
- Update changelog ([rendered](https://github.com/alamb/arrow-datafusion/blob/alamb/prepare_37.1.0/dev/changelog/37.1.0.md))
<!--
There is no need to duplicate the description in the issue here but it is sometimes worth providing a summary of the individual changes in this PR.
-->
## Are these changes tested?
<!--
We typically require tests for all PRs in order to:
1. Prevent the code from being accidentally broken by subsequent changes
2. Serve as another way to document the expected behavior of the code
If tests are not included in your PR, please explain why (for example, are they covered by existing tests)?
-->
## Are there any user-facing changes?
<!--
If there are user-facing changes then we may require documentation to be updated before approving the PR.
-->
<!--
If there are any breaking changes to public APIs, please add the `api change` label.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prepare `37.1.0` release (on `branch-37`) [arrow-datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #10128:
URL: https://github.com/apache/arrow-datafusion/pull/10128#issuecomment-2063872377
I am going to merge without fixing the security CI failure on the 37 branch. If we want to make more releases from 37 we can fix it later
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prepare `37.1.0` release (on `branch-37`) [arrow-datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #10128:
URL: https://github.com/apache/arrow-datafusion/pull/10128#issuecomment-2065322798
Hmm, I appear to have forgotten to merge this PR before sending out the vote thread 🤦
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prepare `37.1.0` release (on `branch-37`) [arrow-datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb merged PR #10128:
URL: https://github.com/apache/arrow-datafusion/pull/10128
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prepare `37.1.0` release (on `branch-37`) [arrow-datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #10128:
URL: https://github.com/apache/arrow-datafusion/pull/10128#issuecomment-2065338836
Created https://github.com/apache/arrow-datafusion/pull/10136 to port these changes to `main`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prepare `37.1.0` release (on `branch-37`) [arrow-datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #10128:
URL: https://github.com/apache/arrow-datafusion/pull/10128#issuecomment-2063655318
Note that the security-audit CI check is failing
https://github.com/apache/arrow-datafusion/actions/runs/8737098473/job/23973329903?pr=10128
```
error: 1 vulnerability found!
Crate: gix-transport
Version: 0.39.0
Title: gix-transport indirect code execution via malicious username
Date: 2024-04-[13](https://github.com/apache/arrow-datafusion/actions/runs/8737098473/job/23973329903?pr=10128#step:4:14)
ID: RUSTSEC-2024-0335
URL: https://rustsec.org/advisories/RUSTSEC-2024-0335
Solution: Upgrade to >=0.42.0
Dependency tree:
gix-transport 0.39.0
├── gix-protocol 0.42.0
│ └── gix 0.56.0
│ └── cargo 0.77.0
│ └── datafusion 37.1.0
│ ├── datafusion-wasmtest 37.1.0
│ ├── datafusion-substrait 37.1.0
│ ├── datafusion-sqllogictest 37.1.0
│ ├── datafusion-proto 37.1.0
│ │ └── datafusion-benchmarks 37.1.0
│ ├── datafusion-examples 37.1.0
│ ├── datafusion-docs-tests 37.1.0
│ └── datafusion-benchmarks 37.1.0
└── gix 0.56.0
```
This is due to a dev dependency on `cargo` in datafusion for the `depcheck` binary
https://github.com/apache/arrow-datafusion/blob/d4eb72c30d45c0f3f359c64f41a6caed30abe750/datafusion/core/Cargo.toml#L133
We removed this dependency from main (38.0.0) but it is still on the `brach-37` https://github.com/apache/arrow-datafusion/pull/9865
Two options:
1. Merge the PR as is (with the CI check failure)
2. Remove the depcheck binary/ci/`cargo` dependnecy from the `branch-37` line to get CI passing cleanly
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org