This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-11936-5746b443f70b4e55676be59cea317501a94ec810 in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
commit 6b4038389141a37d6ded387b69a39b3d24cf3eae Author: RIchard Baah <[email protected]> AuthorDate: Tue Oct 27 16:34:35 2026 +0000 chore: update tonic to 0.14.7 (#11936) Tonic 0.14.7 updates zstd to 0.14.3. Pin the tonic dependencies to that exact release, update the lockfile, and remove the temporary audit exceptions from #11922. No new tests; this is a dependency-only change. The existing Arrow Flight and integration tests pass, and the audit is clean without exceptions. Prepared with AI assistance and reviewed and tested by the author. --- .github/workflows/audit.yml | 9 +------- Cargo.lock | 45 +++++++++++------------------------- arrow-flight/Cargo.toml | 4 ++-- arrow-flight/gen/Cargo.toml | 2 +- arrow-integration-testing/Cargo.toml | 2 +- 5 files changed, 19 insertions(+), 43 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index dfa15307f1..5792aef411 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -37,11 +37,4 @@ jobs: - name: Run audit check # ubuntu-slim has no Rust toolchain to dispatch `cargo audit`, so # call the binary directly. - # tonic 0.14 pins zstd 0.13, but its compression codec doesn't use the - # APIs affected by these advisories. Remove these once tonic updates. - # See https://github.com/grpc/grpc-rust/issues/2960 - run: | - cargo-audit audit \ - --ignore RUSTSEC-2026-0391 \ - --ignore RUSTSEC-2026-0398 \ - --ignore RUSTSEC-2026-0403 + run: cargo-audit audit diff --git a/Cargo.lock b/Cargo.lock index a09c875504..f5e53beba5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -269,7 +269,7 @@ dependencies = [ "tempfile", "tokio", "uuid", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -437,7 +437,7 @@ dependencies = [ "memmap2", "tempfile", "tokio", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -2622,7 +2622,7 @@ dependencies = [ "tempfile", "tokio", "twox-hash", - "zstd 0.14.3", + "zstd", ] [[package]] @@ -3885,9 +3885,9 @@ dependencies = [ [[package]] name = "tonic" -version = "0.14.6" +version = "0.14.7" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef" +checksum = "16ea7e687c08008d22518056608ad0c1cc721204d30ed48c8439a88ae5b9fc73" dependencies = [ "async-trait", "axum", @@ -3909,19 +3909,20 @@ dependencies = [ "tokio", "tokio-rustls", "tokio-stream", + "tokio-util", "tower", "tower-layer", "tower-service", "tracing", "webpki-roots", - "zstd 0.13.3", + "zstd", ] [[package]] name = "tonic-build" -version = "0.14.6" +version = "0.14.7" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "c68f61875ac5293cf72e6c8cf0158086428c82c37229e98c840878f1706b0322" +checksum = "040c96f2ebcbe22118dfa258310dad07002ccf92139370cf69532e4047c7d400" dependencies = [ "prettyplease", "proc-macro2", @@ -3931,9 +3932,9 @@ dependencies = [ [[package]] name = "tonic-prost" -version = "0.14.6" +version = "0.14.7" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0" +checksum = "8fe9efdab8bb668f5ef526e21c247c8cb658853a754983cb70f1dac3fc4f462a" dependencies = [ "bytes", "prost", @@ -3942,9 +3943,9 @@ dependencies = [ [[package]] name = "tonic-prost-build" -version = "0.14.6" +version = "0.14.7" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "654e5643eff75d7f8c99197ce1440ed19a3474eada74c12bbac488b2cafdae27" +checksum = "8b0e0e10c4980146d75d5acfe4f7a9822278130ca2025c0dc25c82f7307d63ac" dependencies = [ "prettyplease", "proc-macro2", @@ -4699,31 +4700,13 @@ version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b" -[[package]] -name = "zstd" -version = "0.13.3" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" -dependencies = [ - "zstd-safe 7.2.4", -] - [[package]] name = "zstd" version = "0.14.3" source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70" dependencies = [ - "zstd-safe 8.2.0", -] - -[[package]] -name = "zstd-safe" -version = "7.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d" -dependencies = [ - "zstd-sys", + "zstd-safe", ] [[package]] diff --git a/arrow-flight/Cargo.toml b/arrow-flight/Cargo.toml index dc5935d0cc..790633d39a 100644 --- a/arrow-flight/Cargo.toml +++ b/arrow-flight/Cargo.toml @@ -45,8 +45,8 @@ prost = { version = "0.14.1", default-features = false, features = ["derive"] } # For Timestamp type prost-types = { version = "0.14.1", default-features = false } tokio = { version = "1.0", default-features = false, features = ["macros", "rt", "rt-multi-thread"], optional = true } -tonic = { version = "0.14.1", default-features = false, features = ["transport", "codegen", "router"] } -tonic-prost = { version = "0.14.1", default-features = false } +tonic = { version = "=0.14.7", default-features = false, features = ["transport", "codegen", "router"] } +tonic-prost = { version = "=0.14.7", default-features = false } # CLI-related dependencies anyhow = { version = "1.0", optional = true } diff --git a/arrow-flight/gen/Cargo.toml b/arrow-flight/gen/Cargo.toml index ddd7259a27..73134cffc8 100644 --- a/arrow-flight/gen/Cargo.toml +++ b/arrow-flight/gen/Cargo.toml @@ -32,7 +32,7 @@ publish = false # Pin specific version of the tonic-build dependencies to avoid auto-generated # (and checked in) arrow.flight.protocol.rs from changing prost-build = { version = "0.14.1", default-features = false } -tonic-prost-build = { version = "0.14.1", default-features = false } +tonic-prost-build = { version = "=0.14.7", default-features = false } [lints] workspace = true diff --git a/arrow-integration-testing/Cargo.toml b/arrow-integration-testing/Cargo.toml index 5e7b30efb7..286166eeb3 100644 --- a/arrow-integration-testing/Cargo.toml +++ b/arrow-integration-testing/Cargo.toml @@ -41,7 +41,7 @@ futures = { version = "0.3", default-features = false } prost = { version = "0.14.1", default-features = false } serde_json = { version = "1.0", default-features = false, features = ["std"] } tokio = { version = "1.0", default-features = false, features = [ "rt-multi-thread"] } -tonic = { version = "0.14.1", default-features = false } +tonic = { version = "=0.14.7", default-features = false } tracing-subscriber = { version = "0.3.1", default-features = false, features = ["fmt"], optional = true } flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
