Repository navigation
[58_maintenance] chore: update webpki dependencies to fix cargo audit CI - #11794
Merged
Merged
Conversation
4 of 5 tasks
Contributor
Author
|
I am also going to merge this one in to get a clean CI on 58 |
Jefffrey
approved these changes
Oct 22, 2026
Contributor
Author
|
Thanks @Jefffrey -- I am trying to get the branches in shape |
Jefffrey
added
the
development-process
Jefffrey
added a commit
that referenced
this pull request
Oct 23, 2026
# Which issue does this PR close? - Part of #11665 # Rationale for this change Prepare for the `58.4.1` patch release from the `58_maintenance` branch # What changes are included in this PR? 1. Update version to `58.4.1` 2. Move the `58.4.0` changelog entry into `CHANGELOG-old.md` 3. Add `58.4.1` CHANGELOG (see rendered version https://github.com/alamb/arrow-rs/blob/alamb/prepare_58.4.1/CHANGELOG.md) Note: the changelog was generated with `git-cliff` using the `cliff.toml` from `main` (the `58_maintenance` branch predates it), with the "Full Changelog" compare link corrected to `58.4.0...58.4.1`. The cargo-audit dependency bumps #11821 and #11794 appear under "Miscellaneous" because they are not labeled `development-process`. # Are these changes tested? By CI # Are there any user-facing changes? New version and changelog 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Jefffrey <jeffrey.vo.australia@gmail.com>
mbutrovich
pushed a commit
to mbutrovich/arrow-rs
that referenced
this pull request
Oct 23, 2026
…stead of pinning runners (apache#11799) # Which issue does this PR close? - Closes apache#11789 # Rationale for this change The `ubuntu-latest` runner label is [migrating from Ubuntu 24.04 to 26.04](https://github.blog/changelog/2026-09-17-ubuntu-26-generally-available-and-latest-migration/) between October 19 and November 19, 2026. Three jobs on `main` break on the new image (see https://github.com/apache/arrow-rs/actions/runs/39673895251): | Job | Failure on 26.04 | | --- | --- | | dev / Release Audit Tool (RAT) | `The version '3.8' with architecture 'x64' was not found for Ubuntu 26.04` | | integration / Pyarrow C Data Interface | same: no Python 3.8 in the toolcache | | parquet / PySpark Integration Test | `java.lang.UnsupportedOperationException: getSubject is not supported` | The maintenance branches were fixed by pinning those jobs back to `ubuntu-24.04` (apache#11778, apache#11781). This PR instead updates the jobs so they run on the current image, as suggested in the issue. # What changes are included in this PR? - **RAT** (`dev.yml`): Python `3.8` → `3.12`. `check-rat-report.py` only uses the standard library. - **Pyarrow C Data Interface** (`integration.yml`): Python `3.8` → `3.12`. 3.12 is the newest version with wheels for every pyarrow in the matrix (`15`, `16`, `17`); pyarrow 15 has no 3.13 wheels, and `pyarrow==15` resolves to 15.0.2 which pins `numpy<2`, so the install still works. `pyo3` 0.29 supports 3.12. - **PySpark Integration Test** (`parquet.yml`): add an `actions/setup-java` step for Temurin 17. The 26.04 image ships JDK 11/17/21/25 with 25 as default; `Subject.getSubject` is disabled on JDK 24+ (JEP 486) so Hadoop/Spark 3.5 cannot start a `SparkContext`. Spark 3.5 supports Java 8/11/17, and 17 is already in the runner toolcache so the step is fast. `actions/setup-java` is pinned by SHA to `v6.1.0`, matching the convention for other actions in this repo. No RUSTSEC / `cargo audit` changes are needed on `main`: the `rustls-webpki` / `webpki-roots` updates from the maintenance branches (apache#11793, apache#11794) were originally made on `main` in apache#11752, and `main` already has `quick-xml` 0.41.0 so it does not need the `--ignore RUSTSEC-2026-0194/0195` flags the maintenance branches carry. # Are these changes tested? By CI on this PR. Whether the jobs land on a 24.04 or 26.04 runner during the rollout window, all three should pass with these settings. # Are there any user-facing changes? No --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
58.4.1(October 2026) #11665 (58.4.1 release)Rationale for this change
The
Auditjob fails on58_maintenancebecause two advisories were published against versions pinned in the committedCargo.lock:rustls-webpki0.103.15 (fixed in 0.103.16)webpki-roots1.0.9 (fixed in 1.0.10)Reproduced locally by running the CI
cargo auditinvocation (with the workflow's--ignorelist) against the branch, which reports exactly these two vulnerabilities.This is the same fix as #11752 on
mainand #11793 on59_maintenance.What changes are included in this PR?
Update only the two flagged crates in
Cargo.lock:Verified locally that the CI
cargo auditinvocation passes afterwards, and that the lockfile resolves withcargo +1.85.0 metadata --locked. Both new versions haverust-version = "1.71", below the workspace MSRV of 1.85.Are these changes tested?
CI
Are there any user-facing changes?
No. This only affects the lockfile used for workspace builds and CI.