This is an automated email from the ASF dual-hosted git repository. JingsongLi pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/paimon-rust.git
The following commit(s) were added to refs/heads/main by this push:
new dd93d9e4 fix(ci): update zstd dependencies for security checks (#1229)
dd93d9e4 is described below
commit dd93d9e4bdbb7a670c4511b6baf1cbce29fce0c2
Author: XiaoHongbo <[email protected]>
AuthorDate: Tue Oct 27 14:53:37 2026 +0800
fix(ci): update zstd dependencies for security checks (#1229)
---
Cargo.lock | 58 ++++++++++++++--------
DEPENDENCIES.rust.tsv | 8 +--
benchmarks/tpcds/DEPENDENCIES.rust.tsv | 8 +--
bindings/c/DEPENDENCIES.rust.tsv | 6 +--
bindings/go/DEPENDENCIES.rust.tsv | 6 +--
bindings/python/DEPENDENCIES.rust.tsv | 8 +--
crates/integration_tests/DEPENDENCIES.rust.tsv | 6 +--
.../integrations/datafusion/DEPENDENCIES.rust.tsv | 8 +--
crates/paimon-rest-server/DEPENDENCIES.rust.tsv | 6 +--
crates/paimon/DEPENDENCIES.rust.tsv | 6 +--
deny.toml | 5 ++
11 files changed, 78 insertions(+), 47 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index e0c3ec05..b22c9933 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -171,7 +171,7 @@ dependencies = [
"strum_macros",
"thiserror 2.0.19",
"uuid",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -349,7 +349,7 @@ dependencies = [
"arrow-select",
"flatbuffers",
"lz4_flex 0.13.1",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -1239,24 +1239,24 @@ dependencies = [
[[package]]
name = "compression-codecs"
-version = "0.4.38"
+version = "0.4.46"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+checksum = "cae36683101b2899f48bd31f8db9839437356188e3b1ff23096e73dab09ba8fe"
dependencies = [
"bzip2",
"compression-core",
"flate2",
"liblzma",
"memchr",
- "zstd",
- "zstd-safe",
+ "zstd 0.14.3",
+ "zstd-safe 8.2.0",
]
[[package]]
name = "compression-core"
-version = "0.4.32"
+version = "0.4.34"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
+checksum = "2ebdda89edc534bf8d5dd2857562633b6495557e5846552ade994b99ed13c36a"
[[package]]
name = "concurrent-queue"
@@ -1615,7 +1615,7 @@ dependencies = [
"tokio",
"url",
"uuid",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -1736,7 +1736,7 @@ dependencies = [
"tokio",
"tokio-util",
"url",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -3371,7 +3371,7 @@ source =
"registry+https://github.com/rust-lang/crates.io-index";
checksum = "44fbb9c5ccb9a5b67b4afa2974c27e5507ea1bf6d22828cef418e4dfaeca51dd"
dependencies = [
"libflate",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -4605,7 +4605,7 @@ dependencies = [
"snafu 0.8.9",
"snap",
"tokio",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -4731,7 +4731,7 @@ dependencies = [
"url",
"uuid",
"vortex",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -4822,7 +4822,7 @@ dependencies = [
"arrow-array",
"arrow-buffer",
"arrow-schema",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -4934,7 +4934,7 @@ dependencies = [
"thrift",
"tokio",
"twox-hash",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -6938,7 +6938,7 @@ dependencies = [
"tantivy-bitpacker",
"tantivy-common",
"tantivy-fst",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -8026,7 +8026,7 @@ dependencies = [
"vortex-error",
"vortex-mask",
"vortex-session",
- "zstd",
+ "zstd 0.13.3",
]
[[package]]
@@ -8643,7 +8643,16 @@ version = "0.13.3"
source = "registry+https://github.com/rust-lang/crates.io-index";
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
dependencies = [
- "zstd-safe",
+ "zstd-safe 7.2.4",
+]
+
+[[package]]
+name = "zstd"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index";
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
+dependencies = [
+ "zstd-safe 8.2.0",
]
[[package]]
@@ -8655,11 +8664,20 @@ dependencies = [
"zstd-sys",
]
+[[package]]
+name = "zstd-safe"
+version = "8.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index";
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
+dependencies = [
+ "zstd-sys",
+]
+
[[package]]
name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
dependencies = [
"cc",
"pkg-config",
diff --git a/DEPENDENCIES.rust.tsv b/DEPENDENCIES.rust.tsv
index a2b248ea..339deec5 100644
--- a/DEPENDENCIES.rust.tsv
+++ b/DEPENDENCIES.rust.tsv
@@ -110,8 +110,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -737,5 +737,7 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected] X
[email protected]+zstd.1.5.7 X
diff --git a/benchmarks/tpcds/DEPENDENCIES.rust.tsv
b/benchmarks/tpcds/DEPENDENCIES.rust.tsv
index 3fb8d9d3..33013141 100644
--- a/benchmarks/tpcds/DEPENDENCIES.rust.tsv
+++ b/benchmarks/tpcds/DEPENDENCIES.rust.tsv
@@ -72,8 +72,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -481,5 +481,7 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected] X
[email protected]+zstd.1.5.7 X
diff --git a/bindings/c/DEPENDENCIES.rust.tsv b/bindings/c/DEPENDENCIES.rust.tsv
index f61e4423..49c9c844 100644
--- a/bindings/c/DEPENDENCIES.rust.tsv
+++ b/bindings/c/DEPENDENCIES.rust.tsv
@@ -62,8 +62,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -442,4 +442,4 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected]+zstd.1.5.7 X
diff --git a/bindings/go/DEPENDENCIES.rust.tsv
b/bindings/go/DEPENDENCIES.rust.tsv
index f61e4423..49c9c844 100644
--- a/bindings/go/DEPENDENCIES.rust.tsv
+++ b/bindings/go/DEPENDENCIES.rust.tsv
@@ -62,8 +62,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -442,4 +442,4 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected]+zstd.1.5.7 X
diff --git a/bindings/python/DEPENDENCIES.rust.tsv
b/bindings/python/DEPENDENCIES.rust.tsv
index 654e8af7..30d84a94 100644
--- a/bindings/python/DEPENDENCIES.rust.tsv
+++ b/bindings/python/DEPENDENCIES.rust.tsv
@@ -80,8 +80,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -619,5 +619,7 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected] X
[email protected]+zstd.1.5.7 X
diff --git a/crates/integration_tests/DEPENDENCIES.rust.tsv
b/crates/integration_tests/DEPENDENCIES.rust.tsv
index 47fca3ca..a53e5ee5 100644
--- a/crates/integration_tests/DEPENDENCIES.rust.tsv
+++ b/crates/integration_tests/DEPENDENCIES.rust.tsv
@@ -57,8 +57,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -406,4 +406,4 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected]+zstd.1.5.7 X
diff --git a/crates/integrations/datafusion/DEPENDENCIES.rust.tsv
b/crates/integrations/datafusion/DEPENDENCIES.rust.tsv
index 6b1bb640..767e3cdf 100644
--- a/crates/integrations/datafusion/DEPENDENCIES.rust.tsv
+++ b/crates/integrations/datafusion/DEPENDENCIES.rust.tsv
@@ -86,8 +86,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -636,5 +636,7 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected] X
[email protected]+zstd.1.5.7 X
diff --git a/crates/paimon-rest-server/DEPENDENCIES.rust.tsv
b/crates/paimon-rest-server/DEPENDENCIES.rust.tsv
index 38d49be9..a606fe3d 100644
--- a/crates/paimon-rest-server/DEPENDENCIES.rust.tsv
+++ b/crates/paimon-rest-server/DEPENDENCIES.rust.tsv
@@ -60,8 +60,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -412,4 +412,4 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected]+zstd.1.5.7 X
diff --git a/crates/paimon/DEPENDENCIES.rust.tsv
b/crates/paimon/DEPENDENCIES.rust.tsv
index dc4c7278..c478c403 100644
--- a/crates/paimon/DEPENDENCIES.rust.tsv
+++ b/crates/paimon/DEPENDENCIES.rust.tsv
@@ -90,8 +90,8 @@ [email protected] X
X
[email protected] X
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
[email protected] X
X
@@ -641,4 +641,4 @@ [email protected]
X
[email protected]
X
[email protected]
X
[email protected] X
X
[email protected]+zstd.1.5.7 X
X
[email protected]+zstd.1.5.7 X
diff --git a/deny.toml b/deny.toml
index ebbe91cd..c90ff13d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -20,6 +20,11 @@ ignore = [
{ id = "RUSTSEC-2023-0071", reason = "No fixed version; reqsign only signs
locally generated outbound requests and exposes no remote signing or decryption
timing oracle." },
{ id = "RUSTSEC-2026-0176", reason = "The affected PyList and PyTuple
iterator APIs are unused." },
{ id = "RUSTSEC-2026-0177", reason = "PyCFunction::new_closure is unused."
},
+ # zstd 0.13 is still required by Arrow, DataFusion, Parquet, and other
upstream crates.
+ # Revisit these API-specific exceptions as those dependencies adopt zstd
0.14.
+ { id = "RUSTSEC-2026-0391", reason = "No caller uses the affected raw
Encoder/Decoder::with_context constructors." },
+ { id = "RUSTSEC-2026-0398", reason = "The affected zstd-safe seekable
feature is not enabled." },
+ { id = "RUSTSEC-2026-0403", reason = "No old zstd caller uses
write::Decoder or raw streaming decode; compression-codecs now uses patched
zstd-safe 8.2." },
]
[licenses]
