From d6bc24a47102f105249832173b87533f6bef50d7 Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevin.jq.liu@gmail.com>
Date: Fri, 4 Sep 2026 11:40:19 -0700
Subject: [PATCH] chore(deps): remove dead datafusion-ffi, unused workspace
 deps, and stale audit ignores

Follow-up cleanup after the DataFusion TableProvider removal (#3143).

- Remove `datafusion-ffi` from workspace deps; nothing inherits it since
  the Python binding no longer exports a TableProvider.
- Remove `aes` and `thrift` workspace deps; no crate inherits them
  (encryption uses the AES types re-exported by `aes-gcm`).
- Drop audit ignores whose advisory no longer matches any locked crate:
  RUSTSEC-2024-0014 (generational-arena, gone with datafusion-ffi),
  RUSTSEC-2024-0388 (derivative), RUSTSEC-2025-0134 (rustls-pemfile),
  RUSTSEC-2026-0097 (rand, all locked versions patched),
  RUSTSEC-2026-0176/0177 (pyo3, lock is on 0.29.1).
- Drop the unmatched MPL-2.0 license exception for generational-arena.

Cargo.lock is unchanged. Verified with `cargo check --workspace
--all-targets --all-features`, `cargo audit`, and `cargo deny check licenses`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .cargo/audit.toml | 27 ---------------------------
 Cargo.toml        |  3 ---
 deny.toml         |  1 -
 3 files changed, 31 deletions(-)

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 7e31efcb19..176d43abf6 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -21,37 +21,10 @@ ignore = [
   # Marvin Attack: potential key recovery through timing sidechannels
   # Issues: https://github.com/apache/iceberg-rust/issues/221
   "RUSTSEC-2023-0071",
-  # `derivative` is unmaintained; consider using an alternative
-  #
-  # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
-  "RUSTSEC-2024-0388",
   # `paste` is unmaintained; consider using an alternative
   #
   # Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
   "RUSTSEC-2024-0436",
-  # `generational-arena` is unmaintained; consider using an alternative
-  #
-  # Introduced by datafusion-ffi through abi_stable/async-ffi until upstream
-  # provides a replacement path.
-  "RUSTSEC-2024-0014",
-  # `rustls-pemfile` is unmaintained
-  #
-  # Introduced by object_store, see https://github.com/apache/arrow-rs-object-store/issues/564
-  "RUSTSEC-2025-0134",
-  # `rand` unsoundness with custom logger using `rand::rng()`
-  #
-  # Direct dependency upgraded to 0.9.3+. Transitive rand 0.8.5 remains
-  # from reqsign/sqllogictest/rustc-hash — no 0.8.x patch exists.
-  "RUSTSEC-2026-0097",
-  # pyo3 < 0.29: out-of-bounds read in PyList/PyTuple `nth`/`nth_back`, and
-  # missing `Sync` bound on `PyCFunction::new_closure` closures.
-  #
-  # Pulled only transitively through arrow's `pyarrow` feature
-  # (arrow-pyarrow), which still pins pyo3 ^0.28 in its latest release; no
-  # arrow build supports the patched pyo3 0.29 yet. Remove once arrow-pyarrow
-  # moves to pyo3 >=0.29.
-  "RUSTSEC-2026-0176",
-  "RUSTSEC-2026-0177",
   # `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and
   # unbounded namespace-declaration allocation (parser DoS).
   #
diff --git a/Cargo.toml b/Cargo.toml
index 8c220f489c..d1083a3dc7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,6 @@ rust-version = "1.95"
 unused_qualifications = "deny"
 
 [workspace.dependencies]
-aes = { version = "0.8", features = ["zeroize"] }
 aes-gcm = "0.10"
 anyhow = "1.0.72"
 apache-avro = { version = "0.21", features = ["snappy", "zstandard"] }
@@ -81,7 +80,6 @@ crc32fast = "1"
 dashmap = "6"
 datafusion = "55.0.0"
 datafusion-cli = "55.0.0"
-datafusion-ffi = "55.0.0"
 datafusion-sqllogictest = "55.0.0"
 derive_builder = "0.20"
 dirs = "6"
@@ -148,7 +146,6 @@ stacker = "0.1.20"
 strum = "0.27.2"
 syn = "2"
 tempfile = "3.18"
-thrift = "0.17.0"
 tokio = { version = "1.47", default-features = false, features = [
   "sync",
   "rt-multi-thread",
diff --git a/deny.toml b/deny.toml
index 11c6dd5dc4..e8c3985e5d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -38,6 +38,5 @@ exceptions = [
   # The MPL license is allowed (binary-only):
   # https://www.apache.org/legal/resolved.html#category-b
   { allow = ["MPL-2.0"], crate = "colored" },
-  { allow = ["MPL-2.0"], crate = "generational-arena" },
   { allow = ["MPL-2.0"], crate = "option-ext" },
 ]