This is an automated email from the ASF dual-hosted git repository.
alamb pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/main by this push:
new 57002ae720 chore: run `cargo update` to bump quinn (#10181)
57002ae720 is described below
commit 57002ae7204ce4c5b41f1681cae70ce746f3804e
Author: Jeffrey Vo <[email protected]>
AuthorDate: Wed Jun 24 04:48:54 2026 +0900
chore: run `cargo update` to bump quinn (#10181)
CI failing on main due to cve
- closes https://github.com/apache/arrow-rs/pull/10201
```
Crate: quinn-proto
Version: 0.11.14
Title: Remote memory exhaustion in quinn-proto from unbounded
out-of-order stream reassembly
Date: 2026-06-22
ID: RUSTSEC-2026-0185
URL: https://rustsec.org/advisories/RUSTSEC-2026-0185
Severity: 7.5 (high)
Solution: Upgrade to >=0.11.15
```
diff is generated by running `cargo update -p quinn` off main
---
Cargo.lock | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 2175011a03..6a6bb51103 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2705,9 +2705,9 @@ dependencies = [
[[package]]
name = "quinn"
-version = "0.11.9"
+version = "0.11.11"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
dependencies = [
"bytes",
"cfg_aliases",
@@ -2725,9 +2725,9 @@ dependencies = [
[[package]]
name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
dependencies = [
"bytes",
"getrandom 0.3.4",
