chore: update object_store dependency and fix build

[michaelkirk]

in 0.13.2, object_store made tokio optional in a patch release

See:
apache/arrow-rs-object-store#644

Ideally this would have been in a object_store 0.14.0 release.

[Copilot]

Pull request overview

Updates the object_store dependency configuration to restore builds after object_store made tokio optional in a patch release.

Changes:

• Pin object_store to 0.13.2 and explicitly enable its tokio feature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.97%. Comparing base (bfea8b7) to head (f981848).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #119   +/-   ##
=======================================
  Coverage   79.97%   79.97%           
=======================================
  Files          12       12           
  Lines        1648     1648           
  Branches     1648     1648           
=======================================
  Hits         1318     1318           
  Misses        225      225           
  Partials      105      105           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nyurik]

thx!

[michaelkirk]

There's still more to do here. There is a vulnerability in a transitive dependency using an old version of rustls. Still investigating.

[michaelkirk]

Here's the error:

security vulnerability detected
...
217 │ rustls-webpki 0.101.7 registry+https://github.com/rust-lang/crates.io-index
...
   ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.101.7
      └── rustls v0.21.12
          ├── aws-smithy-http-client v1.1.12
          │   └── aws-smithy-runtime v1.11.1
          │       ├── aws-runtime v1.7.2
          │       │   └── aws-sdk-s3 v1.129.0
          │       │       └── pmtiles v0.21.0
          │       └── aws-sdk-s3 v1.129.0 (*)
          ├── hyper-rustls v0.24.2
          │   └── aws-smithy-http-client v1.1.12 (*)
          └── tokio-rustls v0.24.1
              └── hyper-rustls v0.24.2 (*)

This seems peculiar:
https://github.com/awslabs/aws-sdk-rust/blob/main/sdk/aws-smithy-http-client/Cargo.toml#L167

Apparently aws-smithy-http-client includes an up-to-date rustls client, but for some reason also includes a legacy tls feature which builds the version of rustls with known vulnerabilities.

I'd wager (but don't actually know) that we're not using this legacy feature, but presumably cargo deny will still be grumpy about it.

update: I think this is similar to awslabs/aws-sdk-rust#1339, so I've piled on there.

[nyurik]

aws crate last time i looked at it is spectacularly bleh, so we may have to exclude the security issue in our deny file

[michaelkirk]

Note: I just pushed up another commit allowing the CC0 and MPL-2.0 licenses which were newly detected in our dependencies. That's a decision above my pay grade for this crate, so FYI.

[nyurik]

hehe, i think you and i are getting paid about the same $0.0 here :)