Skip to content

Commit 3bece3d

Browse files
authored
Upgrade minimal tokio-postgres version to address security advisory (#22937)
## Which issue does this PR close? - Closes #. ## Rationale for this change `cargo audit` currently reports the following vulnerabilities: ``` Crate: postgres-protocol Version: 0.6.11 Title: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service Date: 2026-06-12 ID: RUSTSEC-2026-0179 URL: https://rustsec.org/advisories/RUSTSEC-2026-0179 Severity: 8.7 (high) Solution: Upgrade to >=0.6.12 Crate: postgres-protocol Version: 0.6.11 Title: Panic decoding a malformed `hstore` value allows denial of service Date: 2026-06-12 ID: RUSTSEC-2026-0180 URL: https://rustsec.org/advisories/RUSTSEC-2026-0180 Severity: 6.9 (medium) Solution: Upgrade to >=0.6.12 Crate: tokio-postgres Version: 0.7.17 Title: Panic on a `DataRow` with fewer fields than columns allows denial of service Date: 2026-06-12 ID: RUSTSEC-2026-0178 URL: https://rustsec.org/advisories/RUSTSEC-2026-0178 Severity: 6.9 (medium) Solution: Upgrade to >=0.7.18 ``` ## What changes are included in this PR? Upgrade the minimal version of the `tokio-postgres` dependency ## Are these changes tested? Existing tests ## Are there any user-facing changes? None Signed-off-by: Adam Gutglick <adamgsal@gmail.com>
1 parent 574a1e6 commit 3bece3d

2 files changed

Lines changed: 11 additions & 11 deletions

File tree

Cargo.lock

Lines changed: 10 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

datafusion/sqllogictest/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ tempfile = { workspace = true }
6565
testcontainers-modules = { workspace = true, features = ["postgres"], optional = true }
6666
thiserror = "2.0.18"
6767
tokio = { workspace = true }
68-
tokio-postgres = { version = "0.7.17", optional = true }
68+
tokio-postgres = { version = "0.7.18", optional = true }
6969

7070
[features]
7171
avro = ["datafusion/avro"]

0 commit comments

Comments
 (0)