From 311ded06d0cdd5beb18321a55de874c9c86f6322 Mon Sep 17 00:00:00 2001 From: Xuanwo Date: Tue, 27 Oct 2026 01:02:28 +0800 Subject: [PATCH] fix(ci): acknowledge Arrow-pinned zstd advisories (#4683) RustSec published four `zstd` advisories after #3819 merged, causing the `deny` job to fail on `main`. `arrow-ipc 58.x` pins `zstd ^0.13`, while the patched releases require `zstd >= 0.14.3`; moving to Arrow 59+ requires a coordinated DataFusion and Lance upgrade. This records temporary exceptions with their reachability rationale. LanceDB uses the `zstd::bulk` API through `arrow-ipc`; the affected `with_context`, seekable, and streaming-decoder APIs are not used, and the `zstd-sys` advisory is wasm32-only while wasm32 is not a shipped target. Validation: `cargo-deny 0.20.2` reports `advisories ok, bans ok, licenses ok, sources ok`. --- deny.toml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/deny.toml b/deny.toml index e4982c149..c7a79f469 100644 --- a/deny.toml +++ b/deny.toml @@ -119,6 +119,21 @@ ignore = [ # ship an updated aws-sigv4. # https://rustsec.org/advisories/RUSTSEC-2026-0387 { id = "RUSTSEC-2026-0387", reason = "crypto-bigint via aws-sigv4 (sigv4a); no fixed upstream aws-sigv4 release yet" }, + + # zstd: arrow-ipc 58.x pins zstd ^0.13, while the patches require zstd + # >=0.14.3, zstd-safe >=8.2.0, and zstd-sys >=2.1.2. Arrow 59+ updates the + # dependency, but it cannot be used until DataFusion and Lance move to the + # matching Arrow line. LanceDB uses zstd::bulk through arrow-ipc and does + # not use the affected with_context, seekable, or decompress_stream APIs. + # The zstd-sys advisory is wasm32-only, and wasm32 is not a shipped target. + # https://rustsec.org/advisories/RUSTSEC-2026-0391 + # https://rustsec.org/advisories/RUSTSEC-2026-0398 + # https://rustsec.org/advisories/RUSTSEC-2026-0403 + # https://rustsec.org/advisories/RUSTSEC-2026-0410 + { id = "RUSTSEC-2026-0391", reason = "zstd 0.13 via arrow-ipc 58; affected with_context API is unused" }, + { id = "RUSTSEC-2026-0398", reason = "zstd-safe 7 via arrow-ipc 58; affected seekable API is not enabled" }, + { id = "RUSTSEC-2026-0403", reason = "zstd-safe 7 via arrow-ipc 58; affected streaming decoder API is unused" }, + { id = "RUSTSEC-2026-0410", reason = "zstd-sys via arrow-ipc 58; advisory is wasm32-only and wasm32 is not a shipped target" }, ]