viirya opened a new pull request, #51:
URL: https://github.com/apache/spark-connect-gateway/pull/51
### What changes were proposed in this pull request?
Update two crates in `Cargo.lock` to pick up fixes for nine RustSec
advisories.
Lockfile-only; no `Cargo.toml` change is needed.
```
cargo update -p quinn-proto --precise 0.11.19
cargo update -p rustls --precise 0.23.46
```
The resolved set is **431 crates before and after**; `quinn-proto`
(0.11.16 -> 0.11.19) and `rustls` (0.23.45 -> 0.23.46) are the only two whose
version changes.
### Why are the changes needed?
`cargo audit` against `main` (af4f080) reports these, all with fixed
releases.
**`rustls` 0.23.45 -> 0.23.46.** These apply: the gateway uses rustls as a
TLS
client (`kube-client` for the K8s API, `reqwest` for OIDC JWKS, tonic /
`opentelemetry-otlp`).
| Advisory | Issue |
|---|---|
| RUSTSEC-2026-0346 | `Debug` impls for client session values expose TLS
secrets |
| RUSTSEC-2026-0347 | buffered application data sent to outer server after
ECH rejection |
| RUSTSEC-2026-0348 | brotli certificate decompression can allocate up to 1
GiB before authentication |
| RUSTSEC-2026-0349 | unauthenticated ServerHello can downgrade later
connections to classical key exchange |
**`quinn-proto` 0.11.16 -> 0.11.19.** The gateway is not exposed to these.
`quinn` is enabled only by reqwest's `http3` feature, which the workspace
does
not turn on (`reqwest` is built with `rustls-tls` and `json`), so
`quinn-proto`
appears in `Cargo.lock` but is never compiled. `cargo audit` reads the
lockfile
rather than the build graph, so it still reports them, and updating is
preferable to ignoring advisories that have a fix.
| Advisory | Issue |
|---|---|
| RUSTSEC-2026-0338 | zero-length STREAM frames can panic during unordered
reads |
| RUSTSEC-2026-0339 | unbounded growth of pending connection ID retirements |
| RUSTSEC-2026-0340 | peer minimum ACK delay can panic with ACK_FREQUENCY |
| RUSTSEC-2026-0341 | stream reassembly memory-exhaustion guard can be
bypassed |
| RUSTSEC-2026-0342 | zero-length DATAGRAM frames bypass the receive buffer
limit |
This is also a step toward SPARK-60370 (running `cargo audit` in CI).
**Not covered here:** RUSTSEC-2026-0381 (`webpki-roots`) and
RUSTSEC-2026-0382 (`rustls-webpki`) were published after this change was
prepared and will be handled separately.
### Does this PR introduce _any_ user-facing change?
No. No configuration or API change. The behavioural effect is confined to the
outbound TLS client fixes listed above.
### How was this patch tested?
On the pinned 1.99.0 toolchain:
- `cargo audit` no longer reports any `quinn-proto` or `rustls` advisory.
- `cargo clippy --workspace --all-targets -- -D warnings` -- clean.
- `cargo fmt --all -- --check` -- clean.
- `cargo test --workspace` -- 204 passed, 0 failed, 10 ignored, matching the
baseline on `main`. `rustls` is compiled into the gateway, so this
exercises
the new version.
- The build produces no `quinn` artifact, confirming `quinn-proto` is not
compiled.
- The lockfile claim was checked by comparing the full resolved package set
(name + version for all 431 entries) against `main`, not by reading the
diff.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
