Dependabot can't fix the zip alerts: connector_arrow pins a duckdb that needs zip 6
Maintainers usually reply within 3 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 12/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- build-system, security
Research direction
The vulnerable zip 6.0.0 enters Cargo.lock through libduckdb-sys, pulled in by the test-dbs feature, and the blocker is the duckdb version pinned by connector_arrow. Start by reading the duckdb and connector_arrow entries in the workspace Cargo.toml files and the linked upstream PRs. Done means a prqlc build no longer resolves zip 6 and the Dependabot alerts close, which depends on an upstream connector_arrow release first.
Written by the indexing model from the issue text.
Description
Dependabot alerts #217–#220 flag zip 6.0.0 in Cargo.lock. #217 (GHSA-m665-v7pm-7grj) is critical and patched in 9.0.5. The others (GHSA-q7v9-x93c-xqv3, GHSA-8hxf-qr8p-62x4, GHSA-9hj8-73fh-9963) are patched in 9.0.0. Dependabot couldn't open a fix (run ended in security_update_not_possible, with 6.0.0 as the highest resolvable version), and no lockfile-only bump reaches it.
Why it's stuck: zip is a build-script dependency of libduckdb-sys, which comes in only through the test-dbs features (duckdb for the integration tests). prqlc users don't build it. libduckdb-sys 1.10501.0 (on main) and 1.10505.0 (with #6515) both require zip ^6. 1.10506.1 moves to zip ^9, and 1.20000.x drops zip. But connector_arrow pins duckdb with a tilde requirement (~1.10501.0 in 0.11.0, ~1.10505.0 in the latest release, 0.12.2), and prqlc has to use the same duckdb as connector_arrow to hand it a connection.
What would fix it: a connector_arrow release from its current main. aljazerzen/connector_arrow#84 (merged 2026-10-08) moved it to duckdb ~1.10506.0, which resolves to 1.10506.1 and so to zip 9.x. aljazerzen/connector_arrow#87 (open) would go further, to ~1.20000.0. After that release, prqlc needs a connector_arrow bump with the matching duckdb minimum, building on #6515.
#6445 covered the same chain when zip briefly yanked its pre-9 releases.
- Dominant language
- Rust
- Stars
- 10.9k
- Forks
- 261
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 84
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PRQL/prql
-
Underscore does not work as expectedPossibly taken @prql-bot claimed this 3 days ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 3 days
-
prqlc Debug Report HTML Does Not Escape Source File Name, Enabling Stored XSS via PRQLC_DEBUG_LOGOpenbug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 3 days
-
friendliness integrations
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
PRQL/prql#1636 · 2 comments · 2 reactions ·
Maintainers usually reply within 3 days
-
review-runs-tracking
Difficulty 3/5 Half a day Newbie friendliness 5/100
Maintainers usually reply within 3 days
-
Formatted SQL adds spaces inside the next string literal after a string ending in a backslashMay be free again A pull request for this issue was closed without being merged. Openbug
Difficulty 4/5 1-2 days Newbie friendliness 38/100
Maintainers usually reply within 3 days
Similar issues
-
Windows docs: pin a tested ConPTY version for Kitty graphics; 1.25.260930003 corrupts large uploadsOpen
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
raphamorim/rio#2021 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
hydro-project/infinity#187 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
near/near-sdk-rs#1676 ·
Maintainers usually reply within 2 days
-
auto:producer auto:security
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
fritzprix/libr-agent#2595 ·
Maintainers usually reply within 1 day
-
area:fs type:fix
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Tripstack-Corp/spyc#1002 ·
Maintainers usually reply within 1 day