This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-11930-fd2b5d156d80c986ff9ba5ace2db84500edf50ec in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
commit a45acd6dfc871ebb0b62965a5b016d984589a60d Author: Swapnil Ashtekar <[email protected]> AuthorDate: Tue Oct 27 17:41:54 2026 +0000 Raise arrow-ipc zstd minimum version to 0.14.3 (#11930) # Which issue does this PR close? <!-- It is not necessary to raise an issue, but it is encouraged if it is a non-trivial enhancement/bug. If this PR relates to an existing issue, but does not fully resolve it, please change the wording below from "Closes #NNN" to "Relates to #NNN" or "Part of #NNN" to avoid false closing an issue. --> [`RUSTSEC-2026-0391`](https://rustsec.org/advisories/RUSTSEC-2026-0391.html) # Rationale for this change <!-- Why are you proposing this change? If this is already explained clearly in the issue then this section is not needed. Explaining clearly why changes are proposed helps reviewers understand your changes and offer better suggestions for fixes. Please try to explain the problem you are trying to solve in terms of the user-visible behavior, rather than the implementation. --> Require at least `zstd` 0.14.3 when enabling Zstandard compression in `arrow-ipc`, preventing dependency resolution from selecting versions 0.14.0 through 0.14.2 that are affected by [`RUSTSEC-2026-0391`](https://rustsec.org/advisories/RUSTSEC-2026-0391.html). The workspace lockfile already resolves to 0.14.3, so no lockfile update is required. # What changes are included in this PR? <!-- There is no need to duplicate the description in the issue here but it is sometimes worth providing a summary of the individual changes in this PR. --> - Raise the `arrow-ipc` minimum `zstd` requirement from 0.14.0 to 0.14.3. - Preserve the existing optional dependency and default-feature settings. - Leave `Cargo.lock` unchanged because it already resolves `zstd` to 0.14.3. # Are these changes tested? <!-- We typically require tests for all PRs in order to: 1. Prevent the code from being accidentally broken by subsequent changes 2. Serve as another way to document the expected behavior of the code If tests are not included in your PR, please explain why (for example, are they covered by existing tests, if so identify these tests)? If this PR claims a performance improvement, please include evidence such as benchmark results. DO NOT simply paste a list of commands ran to verify the code; this is what our CI is for and it pollutes the PR. ONLY explain if testing was included with this PR, or why it wasn't. --> No new tests were added because this only tightens a dependency requirement. Existing IPC compression tests cover Zstandard compression and file writing. Validation: `cargo test -p arrow-ipc --features zstd --lib compression --locked` - passed, with 3 tests passing and no lockfile update required. # Are there any significant user-facing changes? <!-- Significant user-facing changes include: - Breaking public API change - Significant change to existing functionality (e.g. function returns something different) These need to be explicitly called out to ensure we have proper documentation if required and to ensure we follow proper semantic versioning. DO NOT restate the changes of this PR; if a bug was fixed and already explained above, we don't need this to be restated as a user-facing change. --> No public API changes or runtime behavior changes are expected when using the existing workspace lockfile. Co-authored-by: Copilot <[email protected]> --- arrow-ipc/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arrow-ipc/Cargo.toml b/arrow-ipc/Cargo.toml index 3d0cd72e1f..a70377694b 100644 --- a/arrow-ipc/Cargo.toml +++ b/arrow-ipc/Cargo.toml @@ -42,7 +42,7 @@ arrow-schema = { workspace = true } arrow-select = { workspace = true} flatbuffers = { version = "25.2.10", default-features = false } lz4_flex = { version = "0.14", default-features = false, features = ["std", "frame"], optional = true } -zstd = { version = "0.14.0", default-features = false, optional = true } +zstd = { version = "0.14.3", default-features = false, optional = true } [features] default = []
