mirror of
https://github.com/lancedb/lancedb.git
synced 2026-10-12 14:52:26 +00:00
Will JonesandClaude Opus 5.5
4b20906eb3
## Summary Fixes the Dependabot alerts for Rust crates that have a patched release. - `Cargo.lock`: aws-smithy-json 0.62.5 → 0.62.7, quinn-proto 0.11.14 → 0.11.19, xxhash-rust 0.8.15 → 0.8.19. - `docs/web-tests/rs/Cargo.lock`: rustls 0.23.35 → 0.23.45, rustls-webpki 0.103.13 → 0.103.15, serde_with 3.16.1 → 3.22.0, rand 0.8.5 → 0.8.8 and 0.9.2 → 0.9.5, xxhash-rust 0.8.15 → 0.8.19. - `rust/lancedb/Cargo.toml`: the AWS SDK crates' default features include the legacy `rustls` feature, which pulls in rustls 0.21 and the vulnerable rustls-webpki 0.101.7 via hyper 0.14. `aws-sdk-bedrockruntime` (behind the optional `bedrock` feature) and the `aws-sdk-s3`/`dynamodb`/`kms` dev-dependencies now use `default-features = false` with `default-https-client` + `rt-tokio`, the same rustls 0.23 client `aws-config` already uses. Minimum versions are raised to the first releases that have `default-https-client`. This removes rustls 0.21, rustls-webpki 0.101, hyper 0.14 and h2 0.3 from the lockfile. Not fixed: fast-float 0.2.0 has no patched release. It comes from polars-arrow via the optional `polars` feature, pinned to `<0.40`; removing it needs a polars upgrade. ## Merge Risk **Door:** two-way; lockfile and dependency-feature changes only. **Blast Radius:** `bedrock` embedding function's HTTP client, and S3/DynamoDB/KMS integration tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>