avantgardnerio opened a new pull request, #2636: URL: https://github.com/apache/datafusion-ballista/pull/2636
## Which issue does this PR close? N/A. Security advisory RUSTSEC-2026-0382. ## Rationale for this change The intermediate keys of emSign ECC Root CA - G3 were compromised on 2026-10-17 due to weak key generation. Ballista's lockfiles pull in vulnerable versions of two crates that carry or validate against it. ## What changes are included in this PR? Lockfile-only bump, no `Cargo.toml` changes: | Crate | Lockfile | From | To | Fix | |---|---|---|---|---| | `webpki-root-certs` | `Cargo.lock` | 1.0.9 | 1.0.10 | removes the emSign root | | `rustls-webpki` | `Cargo.lock`, `python/Cargo.lock` | 0.103.15 | 0.103.16 | SPKI blocklist for the compromised intermediate keys | `webpki-roots` is not in either lockfile. ## Are these changes tested? `cargo check --workspace` passes. Patch-level bumps, no API changes. ## Are there any user-facing changes? TLS connections that chain to the compromised emSign root are now rejected. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
