alamb opened a new pull request, #11793: URL: https://github.com/apache/arrow-rs/pull/11793
# Which issue does this PR close? - Part of #11664 (59.3.2 release) # Rationale for this change The `Audit` job fails on pushes to `59_maintenance` (for example https://github.com/apache/arrow-rs/actions/runs/39722525650/job/119639022597) because two advisories were published against versions pinned in the committed `Cargo.lock`: - RUSTSEC-2026-0382: `rustls-webpki` 0.103.15 (fixed in 0.103.16) - RUSTSEC-2026-0381: `webpki-roots` 1.0.7 (fixed in 1.0.10) This is the same fix as #11752 on `main`. # What changes are included in this PR? Update only the two flagged crates in `Cargo.lock`: ``` cargo update -p rustls-webpki -p webpki-roots ``` Verified locally that `cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195` (the CI invocation) passes, and that the lockfile resolves with `cargo +1.85.0 metadata --locked`. Both new versions have `rust-version = "1.71"`, below the workspace MSRV of 1.85. # Are these changes tested? CI # Are there any user-facing changes? No. This only affects the lockfile used for workspace builds and CI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
