[ARROW-7006] [Rust] Bump flatbuffers version to avoid vulnerability

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.15.0
• Fix Version/s: 0.16.0
• Component/s: Rust
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/23320
• Assignee: Paddy Horan
• Reporter: Paddy Horan
• Created: 28/Oct/19 13:14
• Updated: 11/Jan/23 07:50
• Resolved: 28/Oct/19 19:25

Description

From GitHub use emilk:

cargo audit output:

 

{{ID: RUSTSEC-2019-0028
Crate: flatbuffers
Version: 0.5.0
Date: 2019-10-20
URL: https://github.com/google/flatbuffers/issues/5530
Title: Unsound `impl Follow for bool`}}

The fix should be as simple as editing https://github.com/apache/arrow/blob/master/rust/arrow/Cargo.toml from flatbuffers = "0.5.0" to flatbuffers = "0.6.0"

A more longterm improvement is to add a call to cargo audit in your CI to catch these problems as early as possible

 

Issue Links

• links to: GitHub Pull Request #5744