[
https://issues.apache.org/jira/browse/SPARK-60590?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
L. C. Hsieh resolved SPARK-60590.
---------------------------------
Fix Version/s: connect-gateway-0.1.0
Resolution: Fixed
Issue resolved by pull request 54
[https://github.com/apache/spark-connect-gateway/pull/54]
> Update webpki-roots, rustls-webpki and tokio in Cargo.lock to pick up recent
> RustSec advisories
> -----------------------------------------------------------------------------------------------
>
> Key: SPARK-60590
> URL: https://issues.apache.org/jira/browse/SPARK-60590
> Project: Spark
> Issue Type: Sub-task
> Components: Connect
> Affects Versions: connect-gateway-0.1.0
> Reporter: L. C. Hsieh
> Assignee: L. C. Hsieh
> Priority: Major
> Labels: pull-request-available
> Fix For: connect-gateway-0.1.0
>
>
> The scheduled `cargo audit` run on main has failed daily since it was enabled
> (SPARK-60370). Two of its findings, plus one warning, have fixed releases:
> RUSTSEC-2026-0381 webpki-roots 1.0.9 -> 1.0.10
> Bundled root certificates allow trust in distrusted
> emSign intermediates.
> RUSTSEC-2026-0382 rustls-webpki 0.103.14 -> 0.103.16
> Certificate verification may accept distrusted
> intermediates.
> RUSTSEC-2026-0386 tokio 1.53.1 -> 1.53.3 (reported as a warning: unsound)
> `AsyncFd::new` and related constructors violate I/O
> safety.
> The two webpki advisories affect the gateway: both crates are compiled into
> it and sit on the outbound TLS certificate-verification path (kube-client for
> the K8s API, reqwest for OIDC JWKS, tonic / opentelemetry-otlp).
> This is a lockfile-only change; no Cargo.toml edit is needed.
> The scheduled run's remaining failure, RUSTSEC-2026-0387 (crypto-bigint
> 0.5.5), has no fix reachable from the current dependency graph and is not
> addressed here.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
