Run cargo audit
info: syncing channel updates for 1.96.0-x86_64-unknown-linux-gnu
info: latest update on 2026-05-28 for version 1.96.0 (ac68faa20 2026-05-25)
info: downloading 5 components
Fetching advisory database from `[https://github.com/RustSec/advisory-db.git`](https://github.com/RustSec/advisory-db.git%60)
Loaded 1149 security advisories (from /home/runner/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (664 crate dependencies)
error: 2 vulnerabilities found!
warning: 2 allowed warnings found
Crate: quick-xml
Version: 0.39.2
Title: Quadratic run time when checking a start tag for duplicate attribute names
Date: 2026-06-29
ID: RUSTSEC-2026-0194
URL: https://rustsec.org/advisories/RUSTSEC-2026-0194
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0
Crate: quick-xml
Version: 0.39.2
Title: Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
Date: 2026-06-29
ID: RUSTSEC-2026-0195
URL: https://rustsec.org/advisories/RUSTSEC-2026-0195
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0
Crate: paste
Version: 1.0.15
Warning: unmaintained
Title: paste - no longer maintained
Date: 2024-10-07
ID: RUSTSEC-2024-0436
URL: https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate: anyhow
Version: 1.0.102
Warning: unsound
Title: Unsoundness in `Error::downcast_mut()`
Date: 2026-06-25
ID: RUSTSEC-2026-0190
URL: https://rustsec.org/advisories/RUSTSEC-2026-0190
Error: Process completed with exit code 1.
Describe the bug
Example https://github.com/apache/datafusion/actions/runs/28612921509/job/84849574247
To Reproduce
No response
Expected behavior
No response
Additional context
No response