QuakeWang opened a new pull request, #1194: URL: https://github.com/apache/paimon-rust/pull/1194
### Purpose Restore the shared CI dependency-policy check, which fails on `main` for RUSTSEC-2026-0382 and RUSTSEC-2026-0383. The failure was reproduced locally with CI's pinned cargo-deny 0.19.6 before changing the lockfile. Failure evidence: https://github.com/apache/paimon-rust/actions/runs/39578548467/job/119150565530. ### Brief change log - Update `rustls-webpki` from 0.103.15 to 0.103.16 to reject certificate paths containing distrusted emSign intermediate public keys. - Update `webpki-root-certs` from 1.0.9 to 1.0.10 to remove the affected emSign root. - Regenerate all nine committed dependency reports with cargo-deny 0.19.6. Preserve all other package versions, dependency edges, and advisory-policy settings. ### Tests Passed locally on macOS arm64: - `cargo deny --locked --all-features check --warn unmaintained advisories licenses` with cargo-deny 0.19.6: `advisories ok, licenses ok`; the same command failed for the two advisories before the update. - `python3 scripts/dependencies.py verify` and `python3 scripts/release_licenses.py --check` with cargo-about 0.9.1: all nine dependency reports and 21 generated binary legal files validated. - `cargo +1.94.0 check --locked --workspace --all-targets --all-features`; workspace MSRV metadata validation also passed. - `cargo +1.98.0 test --locked -p paimon --all-targets --features fulltext,vortex`. - `cargo +1.98.0 clippy --locked --all-targets --workspace --features fulltext,vortex -- -D warnings`. - `python3 -m unittest discover -s scripts/tests -p 'test_*.py'`: 13 tests passed; Rust 1.98 formatting, `.asf.yaml` validation, and `git diff --check` passed. An additional lockfile/report comparison verified that only the two intended package versions and checksums changed, all dependency edges are preserved, and all report changes are the corresponding version replacements. Cross-platform execution remains covered by PR CI. ### API and Format No public API or storage-format changes. Both patched dependencies declare Rust 1.71, below the workspace's Rust 1.94 MSRV. ### Documentation Dependency reports are regenerated. Binary license reports are generated and validated using the existing release tooling and excluded from source control as required by that tooling. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
