This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
The following commit(s) were added to refs/heads/main by this push:
new 219571a41 fix: update rustls-webpki and webpki-roots for emSign
advisories (#3496)
219571a41 is described below
commit 219571a4185df2bc6e144dbbcb72cf016714b61b
Author: Dhruv Arya <[email protected]>
AuthorDate: Tue Oct 20 21:07:52 2026 +0000
fix: update rustls-webpki and webpki-roots for emSign advisories (#3496)
* fix: update rustls-webpki and webpki-roots for emSign advisories
Bump rustls-webpki to 0.103.16 and webpki-roots / webpki-root-certs to
1.0.10 to address RUSTSEC-2026-0382, RUSTSEC-2026-0381 and
RUSTSEC-2026-0383. Ignore RUSTSEC-2026-0381 for the webpki-roots 0.26.11
shim pulled in by sqlx-core 0.8.6, which re-exports the fixed 1.0.10.
Co-authored-by: Isaac <[email protected]>
* fix: drop unused sqlx TLS dev feature instead of ignoring
RUSTSEC-2026-0381
The SQL catalog tests only use SQLite, so the tls-rustls feature on the
sqlx dev-dependency is unused. Removing it drops webpki-roots from the
lockfile, so the audit ignore is no longer needed.
Co-authored-by: Isaac <[email protected]>
---------
Co-authored-by: Dhruv Arya <[email protected]>
Co-authored-by: Isaac <[email protected]>
---
.cargo/audit.toml | 7 +++++++
Cargo.lock | 16 ++++++++--------
2 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 176d43abf..a2c3f0f6f 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -37,4 +37,11 @@ ignore = [
# once the transitive dependency set permits quick-xml >=0.41.0.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
+ # `webpki-roots` < 1.0.10 bundles a distrusted emSign root.
+ #
+ # sqlx-core 0.8.6 pulls in webpki-roots 0.26.11, the final 0.26.x release.
+ # It only re-exports webpki-roots 1.x, which the lockfile pins to the fixed
+ # 1.0.10, but cargo-audit flags it by version number. Remove once sqlx moves
+ # to webpki-roots 1.x directly.
+ "RUSTSEC-2026-0381",
]
diff --git a/Cargo.lock b/Cargo.lock
index 41ee99bb6..f0463d1a6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5389,9 +5389,9 @@ checksum =
"f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
[[package]]
name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"aws-lc-rs",
"ring",
@@ -6271,7 +6271,7 @@ source =
"registry+https://github.com/rust-lang/crates.io-index";
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
"once_cell",
"rustix",
"windows-sys 0.61.2",
@@ -7077,9 +7077,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
-version = "1.0.8"
+version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
dependencies = [
"rustls-pki-types",
]
@@ -7090,14 +7090,14 @@ version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index";
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.10",
]
[[package]]
name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
dependencies = [
"rustls-pki-types",
]
