[branch-55] fix: update rustls to address RUSTSEC-2026-0285 (#25309) - #25514
Merged
Merged
Conversation
## Which issue does this PR close? Fixes the [security audit failure](https://github.com/apache/datafusion/actions/runs/34914826729/job/104210077720) caused by [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html). ## Rationale for this change The locked rustls 0.23.39 accepts TLS 1.3 handshake messages across encryption level boundaries and now fails the security audit. Rustls 0.23.45 fixes the vulnerability. ## What changes are included in this PR? Update rustls to 0.23.45 in Cargo.lock, together with its required aws-lc-rs, aws-lc-sys, and rustls-webpki dependency updates. ## What is the testing strategy for this PR? The existing security audit reproduces the vulnerability with the original lockfile and passes with the updated lockfile: ```sh cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195 ``` The workspace extended tests also pass: ```sh RUST_BACKTRACE=1 cargo test --profile ci \ --exclude datafusion-examples --exclude datafusion-benchmarks --exclude datafusion-cli \ --workspace --lib --tests --bins \ --features avro,json,backtrace,extended_tests,recursive_protection,parquet_encryption ``` Also passed `cargo fmt --all`, `cargo clippy --all-targets --all-features -- -D warnings`, and `./dev/rust_lint.sh`. ## Are there any user-facing changes? Builds using the checked-in lockfile use the patched TLS implementation. No DataFusion API changes. (cherry picked from commit 745b1ec)
AdamGS
approved these changes
Sep 19, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## branch-55 #25514 +/- ##
=============================================
- Coverage 81.21% 81.21% -0.01%
=============================================
Files 1110 1110
Lines 388499 388499
Branches 388499 388499
=============================================
- Hits 315513 315510 -3
- Misses 54436 54437 +1
- Partials 18550 18552 +2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
Author
|
Thanks @AdamGS |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
security_auditfailure onbranch-55(for example https://github.com/apache/datafusion/actions/runs/35435408307/job/105877099456 on [branch-55] Reduce datafusion-spark dependency footprint (#24351) #25277)This PR:
Rationale
branch-55locksrustls0.23.39, which is affected by RUSTSEC-2026-0285 ("TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries", published 2026-09-14). Every PR targetingbranch-55now fails thesecurity_auditjob until the lockfile is updated.rustls0.23.45 fixes the vulnerability.The cherry-pick applied cleanly:
branch-55andmainhad identicalrustls,aws-lc-rs,aws-lc-sys, andrustls-webpkientries before the fix.Testing
cargo auditwith the same ignores as the CI job passes on this branch (it fails onbranch-55without this change):cargo fetch --lockedandcargo check --locked -p datafusion-clialso succeed, confirming the updated lockfile resolves and builds.