Skip to content

cargo audit is failing on main #21652

Closed
Closed

Description

@alamb

Describe the bug

Its a new day and we now have a new RUSTSEC failure

Here is an example failure: https://github.com/apache/datafusion/actions/runs/24458936303/job/71467326709

Details

Run cargo audit --ignore RUSTSEC-2024-0014
  cargo audit --ignore RUSTSEC-2024-0014
  shell: /usr/bin/bash -e {0}
info: syncing channel updates for 1.94.0-x86_64-unknown-linux-gnu
info: latest update on 2026-03-05 for version 1.94.0 (4a4ef493e 2026-03-02)
info: downloading 5 components
    Fetching advisory database from `[https://github.com/RustSec/advisory-db.git`](https://github.com/RustSec/advisory-db.git%60)
      Loaded 1046 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (665 crate dependencies)
Crate:     rustls-webpki
Version:   0.103.10
Title:     Name constraints for URI names were incorrectly accepted
Date:      2026-04-14
ID:        RUSTSEC-2026-0098
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0098
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6
Dependency tree:
rustls-webpki 0.103.10
└── rustls 0.23.37
    ├── ureq 3.2.1
    │   └── bollard-buildkit-proto 0.7.0
    │       ├── bollard-stubs 1.52.1-rc.29.1.3
    │       │   └── bollard 0.20.2
    │       │       └── testcontainers 0.27.2
    │       │           └── testcontainers-modules 0.15.0
    │       │               ├── datafusion-sqllogictest 53.0.0
    │       │               └── datafusion-cli 53.0.0
    │       └── bollard 0.20.2
    ├── tokio-rustls 0.26.4
    │   ├── reqwest 0.12.28
    │   │   └── object_store 0.13.2
    │   │       ├── parquet 58.1.0
    │   │       │   ├── datafusion-execution 53.0.0
    │   │       │   │   ├── datafusion-wasmtest 53.0.0
    │   │       │   │   ├── datafusion-spark 53.0.0
    │   │       │   │   │   └── datafusion-sqllogictest 53.0.0
    │   │       │   │   ├── datafusion-session 53.0.0
    │   │       │   │   │   ├── datafusion-ffi 53.0.0
    │   │       │   │   │   │   ├── ffi_module_loader 0.1.0
    │   │       │   │   │   │   ├── ffi_module_interface 0.1.0
    │   │       │   │   │   │   │   ├── ffi_module_loader 0.1.0
    │   │       │   │   │   │   │   └── ffi_example_table_provider 0.1.0
    │   │       │   │   │   │   └── ffi_example_table_provider 0.1.0
    │   │       │   │   │   ├── datafusion-datasource-parquet 53.0.0
    │   │       │   │   │   │   ├── datafusion-proto 53.0.0
    │   │       │   │   │   │   │   ├── datafusion-ffi 53.0.0
    │   │       │   │   │   │   │   ├── datafusion-examples 53.0.0
    │   │       │   │   │   │   │   └── datafusion-benchmarks 53.0.0
    │   │   ├── datafusion-functions-aggregate-common 53.0.0
    │   │   ├── datafusion-functions-aggregate 53.0.0
    │   │   ├── datafusion-functions 53.0.0
    │   │   ├── datafusion-ffi 53.0.0
    │   │   ├── datafusion-expr-common 53.0.0
    │   │   │   ├── datafusion-pruning 53.0.0
    │   │   │   ├── datafusion-physical-optimizer 53.0.0
    │   │   │   ├── datafusion-physical-expr-common 53.0.0
    │   │   │   ├── datafusion-physical-expr 53.0.0
    │   │   │   ├── datafusion-optimizer 53.0.0
    │   │   │   ├── datafusion-functions-nested 53.0.0
    │   │   │   ├── datafusion-functions-aggregate-common 53.0.0
    │   │   │   ├── datafusion-functions 53.0.0
    │   │   │   ├── datafusion-expr 53.0.0
    │   │   │   └── datafusion 53.0.0
    │   │   ├── datafusion-expr 53.0.0
    │   │   ├── datafusion-execution 53.0.0
    │   │   ├── datafusion-examples 53.0.0
    │   │   ├── datafusion-datasource-parquet 53.0.0
    │   │   ├── datafusion-datasource-json 53.0.0
    │   │   ├── datafusion-datasource-csv 53.0.0
    │   │   ├── datafusion-datasource-avro 53.0.0
    │   │   ├── datafusion-datasource-arrow 53.0.0
    │   │   ├── datafusion-datasource 53.0.0
    │   │   ├── datafusion-cli 53.0.0
    │   │   ├── datafusion-catalog-listing 53.0.0
    │   │   ├── datafusion-catalog 53.0.0
    │   │   ├── datafusion-benchmarks 53.0.0
    │   │   └── datafusion 53.0.0
    │   ├── datafusion-cli 53.0.0
    │   ├── datafusion-benchmarks 53.0.0
    │   └── datafusion 53.0.0
    ├── datafusion-wasmtest 53.0.0
    ├── datafusion-substrait 53.0.0
    ├── datafusion-sqllogictest 53.0.0
    ├── datafusion-proto 53.0.0
    ├── datafusion-execution 53.0.0
    ├── datafusion-examples 53.0.0
    ├── datafusion-datasource-parquet 53.0.0
    ├── datafusion-datasource-json 53.0.0
    ├── datafusion-datasource-csv 53.0.0
    ├── datafusion-datasource-avro 53.0.0
    ├── datafusion-datasource-arrow 53.0.0
    ├── datafusion-datasource 53.0.0
    ├── datafusion-common 53.0.0
    ├── datafusion-cli 53.0.0
    ├── datafusion-catalog-listing 53.0.0
    ├── datafusion-catalog 53.0.0
    ├── datafusion-benchmarks 53.0.0
    └── datafusion 53.0.0

To Reproduce

cargo audit --ignore RUSTSEC-2024-0014

Expected behavior

No response

Additional context

No response

Activity

  1. added theissue type on Apr 15, 2026
  2. self-assigned this
    on Apr 15, 2026
  3. added a commit that references this issue on Apr 15, 2026
    7bf39b5
  4. added a commit that references this issue on Apr 21, 2026
    8a73913
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions