rust/lancedb
1
0
Fork 0
mirror of https://github.com/lancedb/lancedb.git synced 2026-10-27 14:06:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): acknowledge Arrow-pinned zstd advisories (#4683)

Browse Source 
RustSec published four `zstd` advisories after #3819 merged, causing the
`deny` job to fail on `main`. `arrow-ipc 58.x` pins `zstd ^0.13`, while
the patched releases require `zstd >= 0.14.3`; moving to Arrow 59+
requires a coordinated DataFusion and Lance upgrade.

This records temporary exceptions with their reachability rationale.
LanceDB uses the `zstd::bulk` API through `arrow-ipc`; the affected
`with_context`, seekable, and streaming-decoder APIs are not used, and
the `zstd-sys` advisory is wasm32-only while wasm32 is not a shipped
target.

Validation: `cargo-deny 0.20.2` reports `advisories ok, bans ok,
licenses ok, sources ok`.
This commit is contained in:
Xuanwo
2026-10-27 01:02:28 +08:00
committed by GitHub
parent 436c209580
commit 311ded06d0
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deny.toml
+15
View File
@@ -119,6 +119,21 @@ ignore = [
# ship an updated aws-sigv4.
# https://rustsec.org/advisories/RUSTSEC-2026-0387
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint via aws-sigv4 (sigv4a); no fixed upstream aws-sigv4 release yet" },
# zstd: arrow-ipc 58.x pins zstd ^0.13, while the patches require zstd
# >=0.14.3, zstd-safe >=8.2.0, and zstd-sys >=2.1.2. Arrow 59+ updates the
# dependency, but it cannot be used until DataFusion and Lance move to the
# matching Arrow line. LanceDB uses zstd::bulk through arrow-ipc and does
# not use the affected with_context, seekable, or decompress_stream APIs.
# The zstd-sys advisory is wasm32-only, and wasm32 is not a shipped target.
# https://rustsec.org/advisories/RUSTSEC-2026-0391
# https://rustsec.org/advisories/RUSTSEC-2026-0398
# https://rustsec.org/advisories/RUSTSEC-2026-0403
# https://rustsec.org/advisories/RUSTSEC-2026-0410
{ id = "RUSTSEC-2026-0391", reason = "zstd 0.13 via arrow-ipc 58; affected with_context API is unused" },
{ id = "RUSTSEC-2026-0398", reason = "zstd-safe 7 via arrow-ipc 58; affected seekable API is not enabled" },
{ id = "RUSTSEC-2026-0403", reason = "zstd-safe 7 via arrow-ipc 58; affected streaming decoder API is unused" },
{ id = "RUSTSEC-2026-0410", reason = "zstd-sys via arrow-ipc 58; advisory is wasm32-only and wasm32 is not a shipped target" },
]