yashaggarwal85d opened a new issue, #26549: URL: https://github.com/apache/datafusion/issues/26549
The `Security audit` workflow (`ci/scripts/security_audit.sh`) now fails on `main` because of two new RustSec advisories against crates in `Cargo.lock`: - `rustls-webpki` 0.103.15: [RUSTSEC-2026-0382](https://rustsec.org/advisories/RUSTSEC-2026-0382), "Certificate verification may accept distrusted intermediates". Fixed in 0.103.16. - `webpki-root-certs` 1.0.9: [RUSTSEC-2026-0383](https://rustsec.org/advisories/RUSTSEC-2026-0383), "Bundled root certificates allow trust in distrusted emSign intermediates". Fixed in 1.0.10. Both are pulled in through the TLS stack used by `object_store` / `reqwest` and the AWS SDK. ### To Reproduce ```shell bash ci/scripts/security_audit.sh # error: 2 vulnerabilities found! ``` ### Expected behavior `cargo audit` passes. ### Additional context Patched versions are semver-compatible, so `cargo update -p [email protected] -p webpki-root-certs` fixes it with a lockfile-only change. I'm happy to open a PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
