You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by gi...@apache.org on 2026/10/22 09:42:32 UTC
(iceberg-rust) branch main updated: chore: clean up audit ignores and cite LEGAL-732 in deny.toml (#3486)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
The following commit(s) were added to refs/heads/main by this push:
new 86e837f90 chore: clean up audit ignores and cite LEGAL-732 in deny.toml (#3486)
86e837f90 is described below
commit 86e837f90d16074d67218db05ffc2629443dafd5
Author: Kevin Liu <ke...@users.noreply.github.com>
AuthorDate: Thu Oct 22 09:30:29 2026 +0000
chore: clean up audit ignores and cite LEGAL-732 in deny.toml (#3486)
* chore: remove stale quick-xml advisory ignores
Cargo.lock now resolves quick-xml to 0.41.0, which contains the fix for
RUSTSEC-2026-0194 and RUSTSEC-2026-0195. `cargo audit` passes without
the ignores, so they no longer suppress anything.
The rsa (RUSTSEC-2023-0071) and paste (RUSTSEC-2024-0436) ignores stay:
both crates are still in Cargo.lock and `cargo audit` fails without them.
Co-authored-by: Copilot App <22...@users.noreply.github.com>
* chore: cite ASF LEGAL-732 for CDLA-Permissive-2.0 in deny.toml
CDLA-Permissive-2.0 was allowed without a justification. ASF LEGAL-732
treats it as Category A, the same reference Apache OpenDAL cites in its
deny.toml. Document it so reviewers can see why it is on the allowlist.
Co-authored-by: Copilot App <22...@users.noreply.github.com>
---------
Co-authored-by: Copilot App <22...@users.noreply.github.com>
---
.cargo/audit.toml | 12 ------------
deny.toml | 1 +
2 files changed, 1 insertion(+), 12 deletions(-)
diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index a2c3f0f6f..706ff2edc 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -25,18 +25,6 @@ ignore = [
#
# Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
"RUSTSEC-2024-0436",
- # `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and
- # unbounded namespace-declaration allocation (parser DoS).
- #
- # It is transitive through object_store 0.13.2 (DataFusion 53 / Parquet 58),
- # OpenDAL 0.57.0, and reqsign-aws-v4 3.0.0. Their released compatible
- # versions cannot select the fixed quick-xml >=0.41.0 release.
- #
- # Per SECURITY-THREAT-MODEL.md, malformed-input parser CPU/memory DoS is
- # hardening rather than an Iceberg Rust trust-boundary vulnerability. Remove
- # once the transitive dependency set permits quick-xml >=0.41.0.
- "RUSTSEC-2026-0194",
- "RUSTSEC-2026-0195",
# `webpki-roots` < 1.0.10 bundles a distrusted emSign root.
#
# sqlx-core 0.8.6 pulls in webpki-roots 0.26.11, the final 0.26.x release.
diff --git a/deny.toml b/deny.toml
index 30c911439..351d8fa47 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,6 +29,7 @@ allow = [
"ISC",
"CC0-1.0",
"Zlib",
+ # Category-A: https://issues.apache.org/jira/browse/LEGAL-732
"CDLA-Permissive-2.0",
# Category-A: https://issues.apache.org/jira/browse/LEGAL-660
"Unicode-3.0",