You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "alamb (via GitHub)" <gi...@apache.org> on 2025/04/03 19:22:39 UTC
[I] `cargo audit` is failing on main [datafusion]
alamb opened a new issue, #15571:
URL: https://github.com/apache/datafusion/issues/15571
### Describe the bug
We are seeing a cargo audit failure on @zebsme 's PR: https://github.com/apache/datafusion/pull/15454
```
Crate: proc-macro-error
Version: 1.0.4
Warning: unmaintained
Title: proc-macro-error is unmaintained
Date: 2024-09-01
ID: RUSTSEC-2024-0370
URL: https://rustsec.org/advisories/RUSTSEC-2024-0370
Dependency tree:
proc-macro-error 1.0.4
└── structopt-derive 0.4.18
└── structopt 0.3.26
└── datafusion-benchmarks 46.0.1
error: 1 vulnerability found!
warning: 3 allowed warnings found
```
The error is actually happening on main as well, but the CI job is only setup to run when Cargo.toml/Cargo.lock changes:
https://github.com/apache/datafusion/blob/ac919d58ad1a472bf0681055f1e243ae329f5389/.github/workflows/audit.yml#L25-L33
The job can start failing when a new entry is added to the database, in addition to when the crates used by datafusion are changed
### To Reproduce
```
# in datafusion directory
cargo audit
```
### Expected behavior
_No response_
### Additional context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `cargo audit` is failing on main [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2779064475
Another approach would be to remove the use of `structopt-derive` in datafusion benchmarks (and update them to use clap directly...)
While more work this would likely be an easier to maintain long term solution
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `security_audit` CI check is failing on main [datafusion]
Posted by "Jiashu-Hu (via GitHub)" <gi...@apache.org>.
Jiashu-Hu commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2784447817
Great, I will go ahead submit a PR to ignore it first
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `cargo audit` is failing on main [datafusion]
Posted by "Jiashu-Hu (via GitHub)" <gi...@apache.org>.
Jiashu-Hu commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2777150559
take
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `cargo audit` is failing on main [datafusion]
Posted by "jayzhan211 (via GitHub)" <gi...@apache.org>.
jayzhan211 commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2777340299
Can we try `proc-macro-error2` or the latest version of `proc-macro-error`? If it is not trivial or causing too much breaking change, then we can add a warning instead
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `cargo audit` is failing on main [datafusion]
Posted by "Jiashu-Hu (via GitHub)" <gi...@apache.org>.
Jiashu-Hu commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2779556820
> Another approach would be to remove the use of `structopt` in datafusion benchmarks (and update them to use clap directly...)
>
> While more work this would likely be an easier to maintain long term solution
>
> https://crates.io/crates/structopt
>
> The docs page basically says it is in maintenance mode; https://docs.rs/structopt/0.3.26/structopt/#maintenance
>
> > As clap v3 is now out, and the structopt features are integrated into (almost as-is), structopt is now in maintenance mode: no new feature will be added.
Using proc-macro-error2 could introduce new issues that are tough to resolve, based on the PR I mentioned earlier. Since we got from their experience, I think we may try replace structopt with clap, I will start working on that
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `security_audit` CI check is failing on main [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb closed issue #15571: `security_audit` CI check is failing on main
URL: https://github.com/apache/datafusion/issues/15571
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `security_audit` CI check is failing on main [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2784594725
Thank you so much @jayzhan211
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `cargo audit` is failing on main [datafusion]
Posted by "Jiashu-Hu (via GitHub)" <gi...@apache.org>.
Jiashu-Hu commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2777171963
For now, it might be best to just allow this warning. Since everything is working fine as it is. Alternatively we could try to use 'proc-macro-error2' instead, but that might cause new problems because it's not exactly the same as the old one.
If you agree with this, I'll submit a PR to add this warning to the allowlist for now.
Found a PR from another community that someone trying to replace it with 'proc-macro-error2': https://github.com/yewstack/yew/pull/3752
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [I] `security_audit` CI check is failing on main [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #15571:
URL: https://github.com/apache/datafusion/issues/15571#issuecomment-2783223654
I agree that removing structopt is the best approach
To fix the CI check, perhaps we can temporarily ignore that warning as it relates to a tool that is not published as part of DataFusion
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org