Deps.rs

apache / arrow-rs

[![dependency status](https://deps.rs/repo/github/apache/arrow-rs/status.svg)](https://deps.rs/repo/github/apache/arrow-rs)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate arrow

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 rand^0.90.9.2up to date
 half^2.12.6.0up to date

Dev dependencies

(6 total, all up-to-date)

CrateRequiredLatestStatus
 criterion^0.60.6.0up to date
 half^2.12.6.0up to date
 rand^0.90.9.2up to date
 serde^1.01.0.219up to date
 memmap2^0.9.30.9.7up to date
 bytes^1.91.10.1up to date

Crate arrow-arith

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 num^0.40.4.3up to date

Crate arrow-array

Dependencies

(5 total, all up-to-date)

CrateRequiredLatestStatus
 chrono-tz^0.100.10.4up to date
 num^0.4.10.4.3up to date
 half^2.12.6.0up to date
 hashbrown^0.15.10.15.4up to date
 ahash^0.80.8.12up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 rand^0.90.9.2up to date
 criterion^0.50.6.0out of date

Crate arrow-avro

Dependencies

(9 total, all up-to-date)

CrateRequiredLatestStatus
 serde_json^1.01.0.141up to date
 serde^1.0.1881.0.219up to date
 flate2^1.01.1.2up to date
 snap^1.01.1.1up to date
 zstd^0.130.13.3up to date
 bzip2^0.6.00.6.0up to date
 xz^0.10.1.0up to date
 crc^3.03.3.0up to date
 uuid^1.171.17.0up to date

Dev dependencies

(6 total, all up-to-date)

CrateRequiredLatestStatus
 rand^0.9.10.9.2up to date
 criterion^0.6.00.6.0up to date
 tempfile^3.33.20.0up to date
 futures^0.3.310.3.31up to date
 bytes^1.10.11.10.1up to date
 async-stream^0.3.60.3.6up to date

Crate arrow-buffer

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 bytes^1.41.10.1up to date
 num^0.40.4.3up to date
 half^2.12.6.0up to date

Dev dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 criterion^0.50.6.0out of date
 rand^0.90.9.2up to date

Crate arrow-cast

Dependencies

(7 total, all up-to-date)

CrateRequiredLatestStatus
 half^2.12.6.0up to date
 num^0.40.4.3up to date
 lexical-core^1.01.0.5up to date
 atoi^2.0.02.0.0up to date
 comfy-table^7.07.1.4up to date
 base64^0.220.22.1up to date
 ryu^1.0.161.0.20up to date

Dev dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 criterion^0.50.6.0out of date
 half^2.12.6.0up to date
 rand^0.90.9.2up to date

Crate arrow-csv

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 csv^1.11.3.1up to date
 csv-core^0.10.1.12up to date
 regex^1.7.01.11.1up to date

Dev dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 tempfile^3.33.20.0up to date
 futures^0.30.3.31up to date
 tokio^1.271.46.1up to date
 bytes^1.41.10.1up to date

Crate arrow-data

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 num^0.40.4.3up to date
 half^2.12.6.0up to date

Crate arrow-flight

Dependencies

(13 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 base64^0.220.22.1up to date
 bytes^11.10.1up to date
 futures^0.30.3.31up to date
 once_cell^11.21.3up to date
 paste^1.01.0.15up to date
 prost^0.13.10.14.1out of date
 prost-types^0.13.10.14.1out of date
 tokio ⚠️^1.01.46.1maybe insecure
 tonic^0.130.13.1up to date
 anyhow^1.01.0.98up to date
 clap^4.4.64.5.41up to date
 tracing-log^0.20.2.0up to date
 tracing-subscriber^0.3.10.3.19up to date

Dev dependencies

(12 total, 1 possibly insecure)

CrateRequiredLatestStatus
 assert_cmd^2.0.82.0.17up to date
 http^1.1.01.3.1up to date
 http-body^1.0.01.0.1up to date
 hyper-util^0.10.1.15up to date
 pin-project-lite^0.20.2.16up to date
 tempfile^3.33.20.0up to date
 tracing-log^0.20.2.0up to date
 tracing-subscriber^0.3.10.3.19up to date
 tokio ⚠️^1.01.46.1maybe insecure
 tokio-stream^0.10.1.17up to date
 tower^0.5.00.5.2up to date
 uuid^1.10.01.17.0up to date

Crate gen

Dependencies

(2 total, 1 outdated)

CrateRequiredLatestStatus
 prost-build=0.13.50.14.1out of date
 tonic-build=0.13.10.13.1up to date

Crate arrow-integration-test

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 hex^0.40.4.3up to date
 serde^1.01.0.219up to date
 serde_json^1.01.0.141up to date
 num^0.40.4.3up to date

Crate arrow-integration-testing

Dependencies

(9 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 clap^44.5.41up to date
 futures^0.30.3.31up to date
 prost^0.130.14.1out of date
 serde^1.01.0.219up to date
 serde_json^1.01.0.141up to date
 tokio ⚠️^1.01.46.1maybe insecure
 tonic^0.130.13.1up to date
 tracing-subscriber^0.3.10.3.19up to date
 flate2^11.1.2up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 tempfile^33.20.0up to date

Crate arrow-ipc

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 flatbuffers^25.2.1025.2.10up to date
 lz4_flex^0.110.11.5up to date
 zstd^0.13.00.13.3up to date

Dev dependencies

(5 total, 1 outdated)

CrateRequiredLatestStatus
 criterion^0.5.10.6.0out of date
 tempfile^3.33.20.0up to date
 tokio^1.43.01.46.1up to date
 memmap2^0.9.30.9.7up to date
 bytes^1.91.10.1up to date

Crate arrow-json

Dependencies

(7 total, all up-to-date)

CrateRequiredLatestStatus
 half^2.12.6.0up to date
 indexmap^2.02.10.0up to date
 num^0.40.4.3up to date
 serde^1.01.0.219up to date
 serde_json^1.01.0.141up to date
 lexical-core^1.01.0.5up to date
 memchr^2.7.42.7.5up to date

Dev dependencies

(7 total, 1 outdated)

CrateRequiredLatestStatus
 flate2^11.1.2up to date
 serde^1.01.0.219up to date
 futures^0.30.3.31up to date
 tokio^1.271.46.1up to date
 bytes^1.41.10.1up to date
 criterion^0.50.6.0out of date
 rand^0.90.9.2up to date

Crate arrow-ord

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 half^2.12.6.0up to date
 rand^0.90.9.2up to date

Crate arrow-pyarrow

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 pyo3^0.25.10.25.1up to date

Crate arrow-row

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 half^2.12.6.0up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 rand^0.90.9.2up to date

Crate arrow-schema

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 serde^1.01.0.219up to date
 bitflags^2.0.02.9.1up to date
 serde_json^1.01.0.141up to date

Dev dependencies

(2 total, 2 outdated)

CrateRequiredLatestStatus
 bincode^1.3.32.0.1out of date
 criterion^0.50.6.0out of date

Crate arrow-select

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 num^0.40.4.3up to date
 ahash^0.80.8.12up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 rand^0.90.9.2up to date

Crate arrow-string

Dependencies

(4 total, all up-to-date)

CrateRequiredLatestStatus
 regex^1.7.01.11.1up to date
 regex-syntax^0.8.00.8.5up to date
 num^0.40.4.3up to date
 memchr^2.7.42.7.5up to date

Crate parquet

Dependencies

(24 total, 3 possibly insecure)

CrateRequiredLatestStatus
 object_store^0.12.00.12.3up to date
 bytes^1.11.10.1up to date
 thrift^0.170.17.0up to date
 snap^1.01.1.1up to date
 brotli^8.08.0.1up to date
 flate2^1.11.1.2up to date
 lz4_flex^0.110.11.5up to date
 zstd^0.130.13.3up to date
 num^0.40.4.3up to date
 num-bigint^0.40.4.6up to date
 base64^0.220.22.1up to date
 clap^4.14.5.41up to date
 serde^1.01.0.219up to date
 serde_json^1.01.0.141up to date
 seq-macro^0.30.3.6up to date
 futures^0.30.3.31up to date
 tokio ⚠️^1.01.46.1maybe insecure
 hashbrown ⚠️^0.150.15.4maybe insecure
 twox-hash^2.02.1.1up to date
 paste^1.01.0.15up to date
 half^2.12.6.0up to date
 crc32fast^1.4.21.5.0up to date
 ring ⚠️^0.170.17.14maybe insecure
 ahash^0.80.8.12up to date

Dev dependencies

(13 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 base64^0.220.22.1up to date
 criterion^0.50.6.0out of date
 snap^1.01.1.1up to date
 tempfile^3.03.20.0up to date
 brotli^8.08.0.1up to date
 flate2^1.01.1.2up to date
 lz4_flex^0.110.11.5up to date
 zstd^0.130.13.3up to date
 serde_json^1.01.0.141up to date
 tokio ⚠️^1.01.46.1maybe insecure
 rand^0.90.9.2up to date
 object_store^0.12.00.12.3up to date
 sysinfo^0.36.00.36.1up to date

Crate parquet-variant

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 indexmap^2.10.02.10.0up to date

Dev dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 paste^1.01.0.15up to date
 criterion^0.60.6.0up to date
 rand^0.90.9.2up to date

Crate parquet-variant-compute

Dev dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 rand^0.9.10.9.2up to date
 criterion^0.60.6.0up to date

Crate parquet-variant-json

Dependencies

(2 total, all up-to-date)

CrateRequiredLatestStatus
 serde_json^1.01.0.141up to date
 base64^0.220.22.1up to date

Crate parquet_derive

Dependencies

(3 total, all up-to-date)

CrateRequiredLatestStatus
 proc-macro2^1.01.0.95up to date
 quote^1.01.0.40up to date
 syn^2.02.0.104up to date

Crate parquet_derive_test

Dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 uuid^11.17.0up to date

Security Vulnerabilities

tokio: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

hashbrown: Borsh serialization of HashMap is non-canonical

RUSTSEC-2024-0402

The borsh serialization of the HashMap did not follow the borsh specification. It potentially produced non-canonical encodings dependent on insertion order. It also did not perform canonicty checks on decoding.

This can result in consensus splits and cause equivalent objects to be considered distinct.

This was patched in 0.15.1.

ring: Some AES functions may panic when overflow checking is enabled.

RUSTSEC-2025-0009

ring::aead::quic::HeaderProtectionKey::new_mask() may panic when overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

On 64-bit targets operations using ring::aead::{AES_128_GCM, AES_256_GCM} may panic when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.