mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-13 16:02:59 +00:00
Alexander PetricandClaude Opus 5
6b00d085e5
`quick-xml` < 0.41 is affected by RUSTSEC-2026-0194 and RUSTSEC-2026-0195 (both CVSS 7.5). The only `object_store` releases that depend on `quick-xml` >= 0.41 are 0.14.1+, and no published `datafusion` release accepts `object_store` 0.14 yet, so `datafusion` is pinned to the apache/datafusion commit that moved to arrow/parquet 60 and `object_store` 0.14.2. That set also drops `thrift` (parquet >= 59 no longer uses it), closing GHSA-2f9f-gq7v-9h6m. - datafusion 47.0.0 -> git 2cac7132 (arrow/parquet 60, object_store 0.14.2) - object_store git 36752c97 (0.12.0) -> 0.14.2; the pinned rev's Azure query-signing fix (arrow-rs-object-store#334) shipped in 0.12.1, so the `[patch.crates-io]` entry and the git dep are both dropped - parquet 55.2.0 -> 60.0.0, arrow 55.2.0 -> 60.0.0 - quick-xml 0.37 -> 0.41; samael pinned forward to the rev that did the same, since it was the other source of a 0.37 copy - tokio =1.46.1 -> =1.53.1, forced by datafusion's `tokio ^1.52` - `reqwest_object_store` (reqwest 0.12) folded into the workspace `reqwest` 0.13, which object_store 0.14 now builds its clients with Code adaptations: `get`/`get_range`/`head`/`delete`/`copy`/`put`/ `put_multipart` moved to `ObjectStoreExt`, `copy`/`rename` to `copy_opts`/`rename_opts`, `delete` to `delete_stream` with a `'static` stream, `Error::NotImplemented` gained fields, `NdJsonReadOptions` became `JsonReadOptions`, `DFSchema: Into<Schema>` is gone, and `set_max_row_group_size` became `set_max_row_group_row_count`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kv72vdCDggCZEjJSmNCwnX