From acfdede19e0a16ea75156146b917fb9ce789b062 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 24 Aug 2026 15:16:19 +0000 Subject: [PATCH] chore(deps): raise the pco floor to 1.0.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workspace declares `pco = "1.0.1"`, but the caret requirement means Cargo.lock has resolved 1.0.3 since it was published — every build and CI run already compiles against 1.0.3. Raise the declared floor to match what is actually built and tested, so the manifest stops advertising support for a version nothing exercises. 1.0.2 and 1.0.3 harden the decoder against corrupt and hostile input: upstream added a mutation-based test suite (`src/tests/corruption.rs`) covering single-bit flips and headers whose declared sizes are not backed by any data, with the contract that the decoder returns a `PcoError` rather than panicking or allocating on an unearned length. Vortex decodes Pco blocks straight out of files it does not control, so that floor is worth stating rather than leaving to lockfile resolution. Lockfile is unchanged — it already points at 1.0.3. Signed-off-by: Joe Isaacs --- Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index 9abe9e379a2..8e43150ba42 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -209,7 +209,7 @@ parquet = "58.3" parquet-variant = "58.3" parquet-variant-compute = "58.3" paste = "1.0.15" -pco = "1.0.1" +pco = "1.0.3" percent-encoding = "2.3.2" pin-project-lite = "0.2.15" primitive-types = { version = "0.14.0" }