You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@datafusion.apache.org by gi...@apache.org on 2026/09/15 05:13:16 UTC
(datafusion) branch gh-readonly-queue/main/pr-25309-cee7bae63ba1ba1213b2c4aaf3bb22d803f50bda created (now 745b1ec218)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a change to branch gh-readonly-queue/main/pr-25309-cee7bae63ba1ba1213b2c4aaf3bb22d803f50bda
in repository https://gitbox.apache.org/repos/asf/datafusion.git
at 745b1ec218 fix: update rustls to address RUSTSEC-2026-0285 (#25309)
This branch includes the following new commits:
new 745b1ec218 fix: update rustls to address RUSTSEC-2026-0285 (#25309)
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@datafusion.apache.org
For additional commands, e-mail: commits-help@datafusion.apache.org
(datafusion) 01/01: fix: update rustls to address RUSTSEC-2026-0285 (#25309)
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-25309-cee7bae63ba1ba1213b2c4aaf3bb22d803f50bda
in repository https://gitbox.apache.org/repos/asf/datafusion.git
commit 745b1ec218d4836ea936a8a89d0cbcc691bbcc05
Author: Xuanwo <gi...@xuanwo.io>
AuthorDate: Tue Sep 15 05:12:52 2026 +0000
fix: update rustls to address RUSTSEC-2026-0285 (#25309)
## Which issue does this PR close?
Fixes the [security audit
failure](https://github.com/apache/datafusion/actions/runs/34914826729/job/104210077720)
caused by
[RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html).
## Rationale for this change
The locked rustls 0.23.39 accepts TLS 1.3 handshake messages across
encryption level boundaries and now fails the security audit. Rustls
0.23.45 fixes the vulnerability.
## What changes are included in this PR?
Update rustls to 0.23.45 in Cargo.lock, together with its required
aws-lc-rs, aws-lc-sys, and rustls-webpki dependency updates.
## What is the testing strategy for this PR?
The existing security audit reproduces the vulnerability with the
original lockfile and passes with the updated lockfile:
```sh
cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
```
The workspace extended tests also pass:
```sh
RUST_BACKTRACE=1 cargo test --profile ci \
--exclude datafusion-examples --exclude datafusion-benchmarks --exclude datafusion-cli \
--workspace --lib --tests --bins \
--features avro,json,backtrace,extended_tests,recursive_protection,parquet_encryption
```
Also passed `cargo fmt --all`, `cargo clippy --all-targets
--all-features -- -D warnings`, and `./dev/rust_lint.sh`.
## Are there any user-facing changes?
Builds using the checked-in lockfile use the patched TLS implementation.
No DataFusion API changes.
---
Cargo.lock | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 1d8ec18f2d..2529044629 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -580,9 +580,9 @@ dependencies = [
[[package]]
name = "aws-lc-rs"
-version = "1.16.3"
+version = "1.18.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
dependencies = [
"aws-lc-sys",
"zeroize",
@@ -590,14 +590,15 @@ dependencies = [
[[package]]
name = "aws-lc-sys"
-version = "0.40.0"
+version = "0.45.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
dependencies = [
"cc",
"cmake",
"dunce",
"fs_extra",
+ "pkg-config",
]
[[package]]
@@ -5434,9 +5435,9 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.39"
+version = "0.23.45"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c2c118cb077cca2822033836dfb1b975355dfb784b5e8da48f7b6c5db74e60e"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
dependencies = [
"aws-lc-rs",
"log",
@@ -5472,9 +5473,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
dependencies = [
"aws-lc-rs",
"ring",
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@datafusion.apache.org
For additional commands, e-mail: commits-help@datafusion.apache.org