This is an automated email from the ASF dual-hosted git repository. XiaoHongbo-Hope pushed a commit to branch release-0.1.0 in repository https://gitbox.apache.org/repos/asf/paimon-full-text.git
commit 23820d27d498e27db7a32b14049ea805291cd53c Author: jianguotian <[email protected]> AuthorDate: Fri Jul 17 18:23:05 2026 +0800 Check Rust advisories and update crossbeam-epoch (#18) Enable cargo-deny advisory checks, update crossbeam-epoch to 0.9.20, and narrowly ignore the unmaintained include-flate proc-macro advisory which has no patched release. Co-authored-by: mingfeng <[email protected]> --- .github/workflows/ci.yml | 3 +++ Cargo.lock | 4 ++-- DEPENDENCIES.rust.tsv | 2 +- deny.toml | 7 +++++++ 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3aec63d..635380f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,6 +65,9 @@ jobs: - name: Check dependency licenses (Apache-compatible) run: cargo deny --locked check licenses + - name: Check Rust security advisories + run: cargo deny --locked check advisories + - name: Verify Rust dependency metadata run: | cargo deny --locked list -f tsv -t 0.6 > /tmp/DEPENDENCIES.rust.tsv diff --git a/Cargo.lock b/Cargo.lock index 040ef91..36bceb3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -210,9 +210,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] diff --git a/DEPENDENCIES.rust.tsv b/DEPENDENCIES.rust.tsv index 3fd9454..f4458ee 100644 --- a/DEPENDENCIES.rust.tsv +++ b/DEPENDENCIES.rust.tsv @@ -23,7 +23,7 @@ [email protected] X [email protected] X X [email protected] X X [email protected] X X [email protected] X X [email protected] X X [email protected] X X [email protected] X [email protected] X diff --git a/deny.toml b/deny.toml index 2e37fb4..5860757 100644 --- a/deny.toml +++ b/deny.toml @@ -29,3 +29,10 @@ allow = [ # crates (adler32, foldhash). Zlib is ASF Category A (permissive). "Zlib", ] + +[advisories] +# This is an unmaintained build-time proc-macro dependency pulled in by +# tantivy-jieba -> jieba-rs -> include-flate. It has no known vulnerability and +# no patched release. Keep the exception narrow so every new vulnerability +# advisory fails CI. +ignore = ["RUSTSEC-2026-0173"]
