kevinjqliu opened a new pull request, #3660: URL: https://github.com/apache/iceberg-rust/pull/3660
## Which issue does this PR close? <!-- We generally require a GitHub issue to be filed for all bug fixes and enhancements and this helps us generate change logs for our releases. You can link an issue to this PR using the GitHub syntax. For example `Closes #123` indicates that this PR will close issue #123. --> N/A. Security audit is failing across PRs on [RUSTSEC-2026-0459](https://rustsec.org/advisories/RUSTSEC-2026-0459.html). ## What changes are included in this PR? <!-- Provide a summary of the modifications in this PR. List the main changes such as new features, bug fixes, refactoring, or any other updates. --> Temporarily excludes the advisory from cargo audit. The fix requires `libsqlite3-sys >= 0.39.0`, but both SQLx 0.8.6 and 0.9.0 exclude that version, so a released dependency upgrade cannot resolve it. The advisory requires opening an attacker-controlled database and WAL file. SQLite is enabled only by dev-dependencies here, and tests create their own databases. Remove the exception once SQLx supports a patched version and the lockfile uses it. This restores the audit check; it does not patch SQLite. ## Are these changes tested? <!-- Specify what test covers (unit test, integration test, etc.). If tests are not included in your PR, please explain why (for example, are they covered by existing tests)? --> `cargo audit --json` passed with zero active vulnerabilities after applying the exception; before the change, it reported RUSTSEC-2026-0459. `git diff --check` passed. No Rust tests were run because only audit configuration changed. ## AI Disclosure <!-- https://iceberg.apache.org/contribute/#guidelines-for-ai-assisted-contributions --> Prepared with GitHub Copilot (GPT-6.1 Sol). Reviewer focus: whether dev-only SQLite usage and tests creating their own databases justify accepting this advisory until a compatible patched dependency is available. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
