From 208fe595a60f98798a77035dd6936d765cefa59f Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sat, 17 Oct 2026 11:15:28 -0700 Subject: [PATCH 1/2] chore: remove stale quick-xml advisory ignores Cargo.lock now resolves quick-xml to 0.41.0, which contains the fix for RUSTSEC-2026-0194 and RUSTSEC-2026-0195. `cargo audit` passes without the ignores, so they no longer suppress anything. The rsa (RUSTSEC-2023-0071) and paste (RUSTSEC-2024-0436) ignores stay: both crates are still in Cargo.lock and `cargo audit` fails without them. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .cargo/audit.toml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 176d43abf6..97b00275c2 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -25,16 +25,4 @@ ignore = [ # # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293 "RUSTSEC-2024-0436", - # `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and - # unbounded namespace-declaration allocation (parser DoS). - # - # It is transitive through object_store 0.13.2 (DataFusion 53 / Parquet 58), - # OpenDAL 0.57.0, and reqsign-aws-v4 3.0.0. Their released compatible - # versions cannot select the fixed quick-xml >=0.41.0 release. - # - # Per SECURITY-THREAT-MODEL.md, malformed-input parser CPU/memory DoS is - # hardening rather than an Iceberg Rust trust-boundary vulnerability. Remove - # once the transitive dependency set permits quick-xml >=0.41.0. - "RUSTSEC-2026-0194", - "RUSTSEC-2026-0195", ] From b404e39dfb0ac3abe0410f919e234a30915909bf Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sat, 17 Oct 2026 11:15:28 -0700 Subject: [PATCH 2/2] chore: cite ASF LEGAL-732 for CDLA-Permissive-2.0 in deny.toml CDLA-Permissive-2.0 was allowed without a justification. ASF LEGAL-732 treats it as Category A, the same reference Apache OpenDAL cites in its deny.toml. Document it so reviewers can see why it is on the allowlist. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- deny.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/deny.toml b/deny.toml index 27c3339ce3..f50c47815b 100644 --- a/deny.toml +++ b/deny.toml @@ -29,6 +29,7 @@ allow = [ "ISC", "CC0-1.0", "Zlib", + # Category-A: https://issues.apache.org/jira/browse/LEGAL-732 "CDLA-Permissive-2.0", # Category-A: https://issues.apache.org/jira/browse/LEGAL-660 "Unicode-3.0",