[
https://issues.apache.org/jira/browse/SPARK-60852?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
L. C. Hsieh resolved SPARK-60852.
---------------------------------
Fix Version/s: connect-gateway-0.1.0
Resolution: Fixed
Issue resolved by pull request 58
[https://github.com/apache/spark-connect-gateway/pull/58]
> Update pulldown-cmark in Cargo.lock to pick up recent RustSec advisories
> ------------------------------------------------------------------------
>
> Key: SPARK-60852
> URL: https://issues.apache.org/jira/browse/SPARK-60852
> Project: Spark
> Issue Type: Sub-task
> Components: Connect
> Affects Versions: connect-gateway-0.1.0
> Reporter: L. C. Hsieh
> Assignee: L. C. Hsieh
> Priority: Major
> Labels: pull-request-available
> Fix For: connect-gateway-0.1.0
>
>
> The scheduled cargo audit run on main has failed every day since 2026-10-29
> because of two advisories against pulldown-cmark 0.13.4:
> - RUSTSEC-2026-0414: exponential event growth with ENABLE_WIKILINKS (fixed in
> 0.13.5)
> - RUSTSEC-2026-0433: quadratic parsing of nested image wikilinks with
> ENABLE_WIKILINKS (fixed in 0.13.6)
> pulldown-cmark is a build-time dependency only: scg-genproto's build script
> uses
> tonic-prost-build, whose prost-build parses the markdown in .proto comments
> with
> Options::all(), which includes ENABLE_WIKILINKS. The input is the vendored
> .proto files in this repository, so the exposure is limited to build time on
> trusted input, and the crate is not linked into the gateway binary.
> prost-build requires pulldown-cmark ^0.13, so the fix is a Cargo.lock-only
> update to 0.13.6. Its dependencies and features are identical to 0.13.4, so no
> other lockfile entries change.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
