Skip to content

chore(deps): remove dead datafusion-ffi, unused workspace deps, and stale audit ignores #3149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kevinjqliu wants to merge 1 commit into
base: main
Choose a base branch
from
+0 −31
Open

chore(deps): remove dead datafusion-ffi, unused workspace deps, and stale audit ignores #3149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 0 additions & 27 deletions .cargo/audit.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,37 +21,10 @@ ignore = [
# Marvin Attack: potential key recovery through timing sidechannels
# Issues: https://github.com/apache/iceberg-rust/issues/221
"RUSTSEC-2023-0071",
# `derivative` is unmaintained; consider using an alternative
#
# Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
"RUSTSEC-2024-0388",
# `paste` is unmaintained; consider using an alternative
#
# Introduced by hive_metastore, tracked at https://github.com/cloudwego/pilota/issues/293
"RUSTSEC-2024-0436",
# `generational-arena` is unmaintained; consider using an alternative
#
# Introduced by datafusion-ffi through abi_stable/async-ffi until upstream
# provides a replacement path.
"RUSTSEC-2024-0014",
# `rustls-pemfile` is unmaintained
#
# Introduced by object_store, see https://github.com/apache/arrow-rs-object-store/issues/564
"RUSTSEC-2025-0134",
# `rand` unsoundness with custom logger using `rand::rng()`
#
# Direct dependency upgraded to 0.9.3+. Transitive rand 0.8.5 remains
# from reqsign/sqllogictest/rustc-hash — no 0.8.x patch exists.
"RUSTSEC-2026-0097",
# pyo3 < 0.29: out-of-bounds read in PyList/PyTuple `nth`/`nth_back`, and
# missing `Sync` bound on `PyCFunction::new_closure` closures.
#
# Pulled only transitively through arrow's `pyarrow` feature
# (arrow-pyarrow), which still pins pyo3 ^0.28 in its latest release; no
# arrow build supports the patched pyo3 0.29 yet. Remove once arrow-pyarrow
# moves to pyo3 >=0.29.
"RUSTSEC-2026-0176",
"RUSTSEC-2026-0177",
# `quick-xml` < 0.41.0 has quadratic duplicate-attribute validation and
# unbounded namespace-declaration allocation (parser DoS).
#
Expand Down
3 changes: 0 additions & 3 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,6 @@ rust-version = "1.95"
unused_qualifications = "deny"

[workspace.dependencies]
aes = { version = "0.8", features = ["zeroize"] }
aes-gcm = "0.10"
anyhow = "1.0.72"
apache-avro = { version = "0.21", features = ["snappy", "zstandard"] }
Expand Down Expand Up @@ -81,7 +80,6 @@ crc32fast = "1"
dashmap = "6"
datafusion = "55.0.0"
datafusion-cli = "55.0.0"
datafusion-ffi = "55.0.0"
datafusion-sqllogictest = "55.0.0"
derive_builder = "0.20"
dirs = "6"
Expand Down Expand Up @@ -148,7 +146,6 @@ stacker = "0.1.20"
strum = "0.27.2"
syn = "2"
tempfile = "3.18"
thrift = "0.17.0"
tokio = { version = "1.47", default-features = false, features = [
"sync",
"rt-multi-thread",
Expand Down
1 change: 0 additions & 1 deletion deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,5 @@ exceptions = [
# The MPL license is allowed (binary-only):
# https://www.apache.org/legal/resolved.html#category-b
{ allow = ["MPL-2.0"], crate = "colored" },
{ allow = ["MPL-2.0"], crate = "generational-arena" },
{ allow = ["MPL-2.0"], crate = "option-ext" },
]
Loading