You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@datafusion.apache.org by gi...@apache.org on 2026/09/15 05:21:58 UTC
(datafusion) branch main updated: fix: update rustls to address RUSTSEC-2026-0285 (#25309)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/datafusion.git
The following commit(s) were added to refs/heads/main by this push:
new 745b1ec218 fix: update rustls to address RUSTSEC-2026-0285 (#25309)
745b1ec218 is described below
commit 745b1ec218d4836ea936a8a89d0cbcc691bbcc05
Author: Xuanwo <gi...@xuanwo.io>
AuthorDate: Tue Sep 15 05:12:52 2026 +0000
fix: update rustls to address RUSTSEC-2026-0285 (#25309)
## Which issue does this PR close?
Fixes the [security audit
failure](https://github.com/apache/datafusion/actions/runs/34914826729/job/104210077720)
caused by
[RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html).
## Rationale for this change
The locked rustls 0.23.39 accepts TLS 1.3 handshake messages across
encryption level boundaries and now fails the security audit. Rustls
0.23.45 fixes the vulnerability.
## What changes are included in this PR?
Update rustls to 0.23.45 in Cargo.lock, together with its required
aws-lc-rs, aws-lc-sys, and rustls-webpki dependency updates.
## What is the testing strategy for this PR?
The existing security audit reproduces the vulnerability with the
original lockfile and passes with the updated lockfile:
```sh
cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
```
The workspace extended tests also pass:
```sh
RUST_BACKTRACE=1 cargo test --profile ci \
--exclude datafusion-examples --exclude datafusion-benchmarks --exclude datafusion-cli \
--workspace --lib --tests --bins \
--features avro,json,backtrace,extended_tests,recursive_protection,parquet_encryption
```
Also passed `cargo fmt --all`, `cargo clippy --all-targets
--all-features -- -D warnings`, and `./dev/rust_lint.sh`.
## Are there any user-facing changes?
Builds using the checked-in lockfile use the patched TLS implementation.
No DataFusion API changes.
---
Cargo.lock | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 1d8ec18f2d..2529044629 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -580,9 +580,9 @@ dependencies = [
[[package]]
name = "aws-lc-rs"
-version = "1.16.3"
+version = "1.18.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
dependencies = [
"aws-lc-sys",
"zeroize",
@@ -590,14 +590,15 @@ dependencies = [
[[package]]
name = "aws-lc-sys"
-version = "0.40.0"
+version = "0.45.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
dependencies = [
"cc",
"cmake",
"dunce",
"fs_extra",
+ "pkg-config",
]
[[package]]
@@ -5434,9 +5435,9 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.39"
+version = "0.23.45"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c2c118cb077cca2822033836dfb1b975355dfb784b5e8da48f7b6c5db74e60e"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
dependencies = [
"aws-lc-rs",
"log",
@@ -5472,9 +5473,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
dependencies = [
"aws-lc-rs",
"ring",
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@datafusion.apache.org
For additional commands, e-mail: commits-help@datafusion.apache.org