You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "Xuanwo (via GitHub)" <gi...@apache.org> on 2026/09/15 03:30:39 UTC
[PR] fix: update rustls to address RUSTSEC-2026-0285 [datafusion]
Xuanwo opened a new pull request, #25309:
URL: https://github.com/apache/datafusion/pull/25309
## Which issue does this PR close?
Fixes the [security audit failure](https://github.com/apache/datafusion/actions/runs/34914826729/job/104210077720) caused by [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html).
## Rationale for this change
The locked rustls 0.23.39 accepts TLS 1.3 handshake messages across encryption level boundaries and now fails the security audit. Rustls 0.23.45 fixes the vulnerability.
## What changes are included in this PR?
Update rustls to 0.23.45 in Cargo.lock, together with its required aws-lc-rs, aws-lc-sys, and rustls-webpki dependency updates.
## What is the testing strategy for this PR?
The existing security audit reproduces the vulnerability with the original lockfile and passes with the updated lockfile:
```sh
cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
```
The workspace extended tests also pass:
```sh
RUST_BACKTRACE=1 cargo test --profile ci \
--exclude datafusion-examples --exclude datafusion-benchmarks --exclude datafusion-cli \
--workspace --lib --tests --bins \
--features avro,json,backtrace,extended_tests,recursive_protection,parquet_encryption
```
Also passed `cargo fmt --all`, `cargo clippy --all-targets --all-features -- -D warnings`, and `./dev/rust_lint.sh`.
## Are there any user-facing changes?
Builds using the checked-in lockfile use the patched TLS implementation. No DataFusion API changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] fix: update rustls to address RUSTSEC-2026-0285 [datafusion]
Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey merged PR #25309:
URL: https://github.com/apache/datafusion/pull/25309
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] fix: update rustls to address RUSTSEC-2026-0285 [datafusion]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #25309:
URL: https://github.com/apache/datafusion/pull/25309#issuecomment-5674479218
## [Codecov](https://app.codecov.io/gh/apache/datafusion/pull/25309?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 81.91%. Comparing base ([`add66e4`](https://app.codecov.io/gh/apache/datafusion/commit/add66e424fa19e9511963a4424661e40dae33e76?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`a853cf3`](https://app.codecov.io/gh/apache/datafusion/commit/a853cf36ffedf5f099627874b643b8f1f65a1b4b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 2 commits behind head on main.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #25309 +/- ##
==========================================
- Coverage 81.91% 81.91% -0.01%
==========================================
Files 1134 1134
Lines 425655 425655
Branches 425655 425655
==========================================
- Hits 348688 348661 -27
- Misses 56288 56310 +22
- Partials 20679 20684 +5
```
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/datafusion/pull/25309?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] fix: update rustls to address RUSTSEC-2026-0285 [datafusion]
Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey commented on PR #25309:
URL: https://github.com/apache/datafusion/pull/25309#issuecomment-5675103285
thanks @Xuanwo
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org