jratliff79 opened a new pull request, #11969: URL: https://github.com/apache/arrow-rs/pull/11969
## Which issue does this PR close? Relates to [RUSTSEC-2026-0391](https://rustsec.org/advisories/RUSTSEC-2026-0391.html), [RUSTSEC-2026-0398](https://rustsec.org/advisories/RUSTSEC-2026-0398.html) and [RUSTSEC-2026-0403](https://rustsec.org/advisories/RUSTSEC-2026-0403.html). ## Rationale for this change Parquet 55.2 still requires zstd 0.13, so consumers of the 55.x line cannot resolve the patched zstd 0.14.3 / zstd-safe 8.2.0 pair. This proposes a focused maintenance-branch update while preserving the existing Arrow types and codec features. The advisory bugs are reproducible at the dependency boundary. This does not claim demonstrated plaintext exposure through Parquet's existing fresh-context codec path. ## What changes are included? Raise both normal and development zstd requirements to 0.14.3. Preserve optional/default-feature settings and all codec implementation code. Add two permanent regressions for abandoned encoder/decoder context reuse. This targets `55_maintenance` because a pinned downstream WAL still depends on Parquet 55.x. A release would be needed before that consumer can remove its temporary local overlay. No whole-Arrow advisory clearance is claimed. ## Are these changes tested? The new regressions both fail on the original maintenance source and pass after the dependency change. The complete compression test module passes all eight tests, including the two new regressions. The changed source file passes rustfmt. Whole-workspace formatting and strict Clippy under Rust 1.96 retain failures in unchanged Arrow files; Clippy stops at lifetime syntax in `arrow-buffer`. No suppression or unrelated source/CI change is included. Hosted CI and maintainer review remain pending. ## Significant user-facing changes The minimum compression dependency changes; public Parquet APIs, codec availability and format are preserved. Historical stored-file corpus testing and a maintenance release are separate gates. Prepared with substantial cloud Codex assistance for regression design, implementation, verification and diff review. AI review is separate from maintainer approval. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
