Dependabot can't fix the zip alerts: connector_arrow pins a duckdb that needs zip 6

Abierto
  • ¿Algo no está bien?
#6,517 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 4 días

@prql-bot ya está trabajando en esto.

Desde el 1/11/2026.

  • #6515 de @prql-bot — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
12/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
build-system, security

Línea de trabajo

The vulnerable zip 6.0.0 enters Cargo.lock through libduckdb-sys, pulled in by the test-dbs feature, and the blocker is the duckdb version pinned by connector_arrow. Start by reading the duckdb and connector_arrow entries in the workspace Cargo.toml files and the linked upstream PRs. Done means a prqlc build no longer resolves zip 6 and the Dependabot alerts close, which depends on an upstream connector_arrow release first.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Dependabot alerts #217–#220 flag zip 6.0.0 in Cargo.lock. #217 (GHSA-m665-v7pm-7grj) is critical and patched in 9.0.5. The others (GHSA-q7v9-x93c-xqv3, GHSA-8hxf-qr8p-62x4, GHSA-9hj8-73fh-9963) are patched in 9.0.0. Dependabot couldn't open a fix (run ended in security_update_not_possible, with 6.0.0 as the highest resolvable version), and no lockfile-only bump reaches it.

Why it's stuck: zip is a build-script dependency of libduckdb-sys, which comes in only through the test-dbs features (duckdb for the integration tests). prqlc users don't build it. libduckdb-sys 1.10501.0 (on main) and 1.10505.0 (with #6515) both require zip ^6. 1.10506.1 moves to zip ^9, and 1.20000.x drops zip. But connector_arrow pins duckdb with a tilde requirement (~1.10501.0 in 0.11.0, ~1.10505.0 in the latest release, 0.12.2), and prqlc has to use the same duckdb as connector_arrow to hand it a connection.

What would fix it: a connector_arrow release from its current main. aljazerzen/connector_arrow#84 (merged 2026-10-08) moved it to duckdb ~1.10506.0, which resolves to 1.10506.1 and so to zip 9.x. aljazerzen/connector_arrow#87 (open) would go further, to ~1.20000.0. After that release, prqlc needs a connector_arrow bump with the matching duckdb minimum, building on #6515.

#6445 covered the same chain when zip briefly yanked its pre-9 releases.

Lenguaje dominante
Rust
Estrellas
10.9k
Forks
261
Merge medio
4 d 6 h
PR fusionados (30 d)
78

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de PRQL/prql

Todos los issues de PRQL/prql

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.