Skip to content

Commit c6a27da

Browse files
committed
Remove dependency on rust_decimal, remove ignore of RUSTSEC-2026-0001 (apache#19666)
- Part of apache#19656 rust_decimal is a one person crate and is released somewhat infrequently * https://github.com/paupino/rust-decimal * https://crates.io/crates/rust_decimal It also uses a non trivial number of dependencies, including https://crates.io/crates/rkyv, some sort of zero copy deserialization framework that was recently subject to a RUSTSEC security advisory, see apache#19656 / apache#19657 Since `rust_decimal` is only used for sqllogictests to parse the results from postgres, we can pretty easily remove the dependency on `rust_decimal` and inline the very small amount functionality we need for sqllogictests This will both decrease the build time and our dependency trail. Removes the `rust_decimal` dependency from DataFusion and inlines the smallest required subset of decimal functionality we need for sqllogictests (which turns out to be pretty small) Yes by CI No, this is all internal testing infrastructure
1 parent aee5cd9 commit c6a27da

File tree

6 files changed

+82
-304
lines changed

6 files changed

+82
-304
lines changed

.github/workflows/audit.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,4 +46,6 @@ jobs:
4646
with:
4747
tool: cargo-audit
4848
- name: Run audit check
49+
# Note: you can ignore specific RUSTSEC issues using the `--ignore` flag ,for example:
50+
# run: cargo audit --ignore RUSTSEC-2026-0001
4951
run: cargo audit

Cargo.lock

Lines changed: 9 additions & 190 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

datafusion/sqllogictest/Cargo.toml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,7 @@ indicatif = "0.18"
5555
itertools = { workspace = true }
5656
log = { workspace = true }
5757
object_store = { workspace = true }
58-
postgres-protocol = { version = "0.6.7", optional = true }
5958
postgres-types = { version = "0.2.11", features = ["derive", "with-chrono-0_4"], optional = true }
60-
rust_decimal = { version = "1.38.0", features = ["tokio-pg"] }
6159
# When updating the following dependency verify that sqlite test file regeneration works correctly
6260
# by running the regenerate_sqlite_files.sh script.
6361
sqllogictest = "0.28.4"
@@ -75,7 +73,6 @@ postgres = [
7573
"bytes",
7674
"chrono",
7775
"postgres-types",
78-
"postgres-protocol",
7976
"testcontainers-modules",
8077
"tokio-postgres",
8178
]

0 commit comments

Comments
 (0)