Skip to content

chore(deps): bump the geoarrow group across 1 directory with 9 updates - #1130

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/geoarrow-696b65a2b0
Open

chore(deps): bump the geoarrow group across 1 directory with 9 updates#1130
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/geoarrow-696b65a2b0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on arrow-array, arrow-cast, arrow-json, arrow-schema, geoarrow-array, geoarrow-schema, geoparquet, object_store and parquet to permit the latest version.
Updates arrow-array to 60.0.0

Release notes

Sourced from arrow-array's releases.

arrow 60.0.0

Changelog

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

... (truncated)

Changelog

Sourced from arrow-array's changelog.

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

Enhancements

... (truncated)

Commits
  • ef1fa15 Update version to 60.0.0 and add CHANGELOG (#11036)
  • f9e02ba perf(variant): resolve borrowed field names without searching the metadata di...
  • a4963a9 minor : batches_to_flight_data() should not require ownership of arguments ...
  • 44141e6 fix(parquet): skip miniblocks wider than 64 values instead of erroring (#11021)
  • 2078680 Prettify RunEndEncoded datatype display (#10840)
  • b7e5977 [Parquet] Populate bloom filters from the dictionary while a column is dictio...
  • 5be0557 [Parquet] Add writer option to skip bloom filters for column chunks whose dat...
  • b06b9c1 fix(arrow-ipc): return an error for a DictionaryBatch without its data (#11020)
  • 8f00fb4 Fix interleave on zero-width FixedSizeListArray (#11026)
  • 2e3a243 chore(deps): bump zstd from 0.13.3 to 0.14.0 (#11024)
  • Additional commits viewable in compare view

Updates arrow-cast to 60.0.0

Release notes

Sourced from arrow-cast's releases.

arrow 60.0.0

Changelog

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

... (truncated)

Changelog

Sourced from arrow-cast's changelog.

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

Enhancements

... (truncated)

Commits
  • ef1fa15 Update version to 60.0.0 and add CHANGELOG (#11036)
  • f9e02ba perf(variant): resolve borrowed field names without searching the metadata di...
  • a4963a9 minor : batches_to_flight_data() should not require ownership of arguments ...
  • 44141e6 fix(parquet): skip miniblocks wider than 64 values instead of erroring (#11021)
  • 2078680 Prettify RunEndEncoded datatype display (#10840)
  • b7e5977 [Parquet] Populate bloom filters from the dictionary while a column is dictio...
  • 5be0557 [Parquet] Add writer option to skip bloom filters for column chunks whose dat...
  • b06b9c1 fix(arrow-ipc): return an error for a DictionaryBatch without its data (#11020)
  • 8f00fb4 Fix interleave on zero-width FixedSizeListArray (#11026)
  • 2e3a243 chore(deps): bump zstd from 0.13.3 to 0.14.0 (#11024)
  • Additional commits viewable in compare view

Updates arrow-json to 60.0.0

Release notes

Sourced from arrow-json's releases.

arrow 60.0.0

Changelog

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

... (truncated)

Changelog

Sourced from arrow-json's changelog.

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

Enhancements

... (truncated)

Commits
  • ef1fa15 Update version to 60.0.0 and add CHANGELOG (#11036)
  • f9e02ba perf(variant): resolve borrowed field names without searching the metadata di...
  • a4963a9 minor : batches_to_flight_data() should not require ownership of arguments ...
  • 44141e6 fix(parquet): skip miniblocks wider than 64 values instead of erroring (#11021)
  • 2078680 Prettify RunEndEncoded datatype display (#10840)
  • b7e5977 [Parquet] Populate bloom filters from the dictionary while a column is dictio...
  • 5be0557 [Parquet] Add writer option to skip bloom filters for column chunks whose dat...
  • b06b9c1 fix(arrow-ipc): return an error for a DictionaryBatch without its data (#11020)
  • 8f00fb4 Fix interleave on zero-width FixedSizeListArray (#11026)
  • 2e3a243 chore(deps): bump zstd from 0.13.3 to 0.14.0 (#11024)
  • Additional commits viewable in compare view

Updates arrow-schema to 60.0.0

Release notes

Sourced from arrow-schema's releases.

arrow 60.0.0

Changelog

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

... (truncated)

Changelog

Sourced from arrow-schema's changelog.

60.0.0 - (2026-09-10)

Full Changelog

Breaking changes

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 22, 2026
@dependabot
dependabot Bot requested a review from gadomski as a code owner September 22, 2026 02:23
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/geoarrow-696b65a2b0 branch 2 times, most recently from beb06b2 to 552a9d6 Compare September 29, 2026 11:43
@dependabot
dependabot Bot force-pushed the dependabot/cargo/geoarrow-696b65a2b0 branch from 552a9d6 to e180996 Compare October 6, 2026 02:23
@dependabot
chore(deps): bump the geoarrow group across 1 directory with 9 updates
c1fc30b 
Updates the requirements on [arrow-array](https://github.com/apache/arrow-rs), [arrow-cast](https://github.com/apache/arrow-rs), [arrow-json](https://github.com/apache/arrow-rs), [arrow-schema](https://github.com/apache/arrow-rs), [geoarrow-array](https://github.com/geoarrow/geoarrow-rs), [geoarrow-schema](https://github.com/geoarrow/geoarrow-rs), [geoparquet](https://github.com/geoarrow/geoarrow-rs), [object_store](https://github.com/apache/arrow-rs-object-store) and [parquet](https://github.com/apache/arrow-rs) to permit the latest version.

Updates `arrow-array` to 60.0.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.0.0...60.0.0)

Updates `arrow-cast` to 60.0.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.0.0...60.0.0)

Updates `arrow-json` to 60.0.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.0.0...60.0.0)

Updates `arrow-schema` to 60.0.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.0.0...60.0.0)

Updates `geoarrow-array` to 0.9.0
- [Release notes](https://github.com/geoarrow/geoarrow-rs/releases)
- [Changelog](https://github.com/geoarrow/geoarrow-rs/blob/main/CHANGELOG.md)
- [Commits](geoarrow/geoarrow-rs@rust-v0.8.0...rust-v0.9.0)

Updates `geoarrow-schema` to 0.9.0
- [Release notes](https://github.com/geoarrow/geoarrow-rs/releases)
- [Changelog](https://github.com/geoarrow/geoarrow-rs/blob/main/CHANGELOG.md)
- [Commits](geoarrow/geoarrow-rs@rust-v0.8.0...rust-v0.9.0)

Updates `geoparquet` to 0.9.0
- [Release notes](https://github.com/geoarrow/geoarrow-rs/releases)
- [Changelog](https://github.com/geoarrow/geoarrow-rs/blob/main/CHANGELOG.md)
- [Commits](geoarrow/geoarrow-rs@rust-v0.8.0...rust-v0.9.0)

Updates `object_store` to 0.14.2
- [Release notes](https://github.com/apache/arrow-rs-object-store/releases)
- [Changelog](https://github.com/apache/arrow-rs-object-store/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs-object-store@v0.13.0...v0.14.2)

Updates `parquet` to 60.0.0
- [Release notes](https://github.com/apache/arrow-rs/releases)
- [Changelog](https://github.com/apache/arrow-rs/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-rs@58.0.0...60.0.0)

---
updated-dependencies:
- dependency-name: arrow-array
  dependency-version: 59.3.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: arrow-cast
  dependency-version: 59.3.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: arrow-json
  dependency-version: 59.3.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: arrow-schema
  dependency-version: 59.3.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: geoarrow-array
  dependency-version: 0.9.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: geoarrow-schema
  dependency-version: 0.9.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: geoparquet
  dependency-version: 0.9.0
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: object_store
  dependency-version: 0.14.1
  dependency-type: direct:production
  dependency-group: geoarrow
- dependency-name: parquet
  dependency-version: 59.3.0
  dependency-type: direct:production
  dependency-group: geoarrow
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/geoarrow-696b65a2b0 branch from e180996 to c1fc30b Compare October 8, 2026 19:09
lowlydba added a commit to OvertureMaps/stac that referenced this pull request Oct 30, 2026
@lowlydba
chore(ci): clear cargo-audit findings for the verify lane
5f92735 
Bump quinn-proto, rustls and rustls-webpki to patched releases. Ignore
the zstd/zstd-safe advisories until the stac crates move to parquet 60
(stac-utils/rustac#1130). Document the pull-requests permission for
zizmor.

Refs #218

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Signed-off-by: John McCall <john@overturemaps.org>
lowlydba added a commit to OvertureMaps/stac that referenced this pull request Oct 30, 2026
@lowlydba
chore(deps): hold parquet, arrow and object_store to the stac crates'…
8fd6d53 
… majors

The stac crates build on parquet 58, so parquet 60 compiled a second
arrow stack. Floor parquet, the arrow dev-deps and object_store to match
until stac-utils/rustac#1130 ships, and have Dependabot ignore newer
majors until then.

Refs #218

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Signed-off-by: John McCall <john@overturemaps.org>
@lowlydba lowlydba mentioned this pull request Oct 30, 2026
Merged
lowlydba added a commit to OvertureMaps/stac that referenced this pull request Oct 30, 2026
@lowlydba
chore!: adopt LF rust-workflows lane, align deps with rustac (#219)
8dcc8e6 
Closes #218

## Context

OvertureMaps/ops-team#632 moves the org's Rust repos onto
[lfreleng-actions/rust-workflows](https://github.com/lfreleng-actions/rust-workflows)
v0.1.0. OvertureMaps/osm-pbf-parquet#61 went first; this is stac.

## Summary

CI built and tested the crate but never audited dependencies, produced
an SBOM, or scanned for vulnerabilities. A new build-test job calls the
lane's `build-test.yaml`, pinned to commit `b7905deb` (v0.1.0). The lane
builds, tests on the project toolchain and on the declared
`rust-version` (1.88), and runs cargo-audit, an SBOM and Grype. Its MSRV
test leg replaces the standalone msrv job, which only built on 1.88. The
rust job keeps fmt, clippy and doc, and the STAC validation jobs are
unchanged.

The lane can't run local composite actions, so the DuckDB CLI install
moves into `.github/scripts/setup-duckdb.sh`. The lane runs it as
`setup_script`, and the setup-duckdb action now calls the same script,
so the version and checksum pin live in one place.

> [!WARNING]
> The lane runs with `harden_runner_egress: audit`, not block. The
DuckDB tests fetch the httpfs and spatial extensions from
extensions.duckdb.org, which the shared allow-list omits. The lane can
only replace that list, not extend it (logged on
OvertureMaps/ops-team#632).

### Dependency changes

cargo-audit failed on the first run. Patched releases fixed quinn-proto,
rustls and rustls-webpki. The rest are ignored in `audit_ignore_vulns`,
each tied to the parquet 58 hold below:

- zstd and zstd-safe (RUSTSEC-2026-0391, -0398, -0403): fixed only in
the zstd that ships with parquet 60
- quick-xml (RUSTSEC-2026-0194, -0195): object_store 0.13 requires
quick-xml 0.39. Both are DoS from XML returned by the endpoint
`--data-uri` names

The stac crates build on parquet 58, so the existing parquet 60 compiled
a second arrow and object_store stack. parquet, object_store and the
arrow dev-deps now match the stac crates' majors, and reqwest moves to
0.13 to match them too. That takes the lockfile from 499 crates to 471.
Dependabot ignores the newer majors until stac-utils/rustac#1130 ships
parquet 60; the ignores and the audit exceptions lift together then.

### Breaking change

The library's public API exposes these crates' types, so the major moves
change it:

- `Bucket.store` and `Bucket.anonymous_fallback` are `Arc<dyn
ObjectStore>` from object_store 0.13
- `Bucket::get_opts` returns `object_store::Result`
- The `ObjectStore`, `Parquet` and `Http` variants of `Error` wrap
object_store 0.13, parquet 58 and reqwest 0.13 errors

A caller that names any of these has to build against object_store 0.13,
parquet 58 and reqwest 0.13. The `!` in the title makes release-plz cut
5.0.0.

### Build time

Build (x64) drops from 8m33s to 1m05s once the cache hits and only one
arrow stack compiles. The partial run restored an older cache key after
the lockfile changed.

```mermaid
%%{init: {"theme": "dark"}}%%
gantt
    title Build (x64) time in the lane (mm:ss)
    dateFormat X
    axisFormat %M:%S
    section 2 stacks
    Cache off 8m33s     : 0, 513
    Cache miss 7m35s    : 0, 455
    section 1 stack
    Cache partial 4m01s : 0, 241
    Cache hit 1m05s     : 0, 65
```

<!--:robot:-->

---------

Signed-off-by: John McCall <john@overturemaps.org>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gadomski gadomski Awaiting requested review from gadomski gadomski is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gadomski