Repository navigation
Conversation
Vedin
marked this pull request as ready for review
November 15, 2026 12:46
Vedin
merged commit Nov 15, 2026
ed46d57
into
fix/schema-modifiers-parser-pin-20261113
35 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
Security-audit prerequisite for #191; no separate issue.
Rationale for this change
The inherited lockfile fails the configured RustSec audit on
quinn-proto0.11.18 (RUSTSEC-2026-0523 and RUSTSEC-2026-0524) andquinn-udp0.5.14 (RUSTSEC-2026-0538). The advisories identify 0.11.19 and 0.5.16 as patched versions in the existing minor series.What changes are included in this PR?
Update only those two Cargo.lock version/checksum pairs. The package count (661), every other package record, every dependency edge, manifests, features, parser pin and workflow policy remain identical to base
a2697caebcbf18efe988acf7b6a8c256fa940d07(fix/schema-modifiers-parser-pin-20261113). Cargo's incidental Windows/rand edge re-resolution was excluded; the minimal lock resolves withcargo metadata --locked --all-features, and both patch checksums match the official registry.This is a separate fork-workspace prerequisite. It does not activate the RELY parser change, change a Rustice pin, or claim downstream lockfile/security qualification.
Are these changes tested?
Actual cargo-audit 0.22.2 against RustSec database
02e2517f457a359fc6d3440ea4560c8ea188fee8: unchanged base exits 1 with the three advisories; candidate exits 0 with zero vulnerabilities under the repository's existing audit policy. The two existing quick-xml ignores and six existing allowed warnings are unchanged; no new ignore is added. The official audit-tool archive SHA-256 was verified before execution.Full
cargo clippy --locked --all-targets --all-features -- -D warningspasses on configured Rust 1.97.0. The full required extended workspace command passes: 10,782 tests, zero failed, ten ignored across 72 lib/test/bin summaries, plus all 509 custom sqllogictest files. The 115-test fuzz suite passes. Final formatting and diff checks pass. The initial extended attempt stopped at core tests because this new worktree's pinned test-data submodules had not been initialized (337 pass / 138 fail); that log is retained. The exact base submodule revisions were then initialized, with no source or expectation change. All commands use an isolated target and at most two build jobs.Are there any user-facing changes?
The fork workspace lock selects the upstream QUIC patch fixes. No DataFusion planner/optimizer/execution source or public API changes.