Security and Dependencies - dathere/qsv GitHub Wiki
Tier: Advanced
qsv has a large dependency tree (~1,000 crates with all_features). To keep it
healthy, qsv runs an automated security audit every day and deals with findings
in one of two ways: patch the dependency at the source (via a fork) when qsv
can fix it, or record a vetted ignore when the finding is a transitive
dependency qsv cannot upgrade directly.
To report a vulnerability, see the repo's SECURITY.md.
The security-audit.yml
GitHub Action runs cargo audit
(via rustsec/audit-check) on a schedule, checking Cargo.lock against the
RustSec Advisory Database. New advisories are filed as
issues automatically.
cargo audit reads its configuration from
.cargo/audit.toml,
which holds the vetted ignore list described below. The same file applies when
you run cargo audit locally.
When the affected crate is one qsv can fix — or it's only a few lines away from
dropping the bad dependency — qsv maintains a patched fork and wires it in via
[patch.crates-io] in Cargo.toml.
This removes the advisory at the source rather than suppressing it.
Forks qsv currently patches in:
| Crate(s) | Fork / source | Why |
|---|---|---|
csv, csv-core, csv-index
|
dathere/rust-csv (qsv-tuned) |
Performance tuning — see Tuned csv Fork Benchmarks |
object_store |
kdn36/arrow-rs-object-store (pinned rev f50a6e5c) |
Adds the with_dns_resolver method polars-io requires |
csvlens |
YS-L/csvlens (pinned rev 6acf060) |
Track upstream rev ahead of a crates.io release |
csvs_convert |
jqnatividad/csvs_convert (replace-streaming-stats-redux) |
Bump dependencies until upstream PR merges |
whatlang |
jqnatividad/whatlang-rs (bump-hashbrown-to-16) |
Bump hashbrown until upstream PR merges |
plotly |
plotly/plotly.rs (pinned rev 00fe0512) |
Our viz charting fixes were merged upstream; tracks them ahead of a crates.io release (previously the dathere/plotly fork) |
self_update |
jaemk/self_update (pinned rev 91b0531a) |
Fixes ahead of a crates.io release |
spreadsheet-ods |
jqnatividad/spreadsheet-ods (deps-bump-202607) |
Bump dependencies until upstream PR merges |
polars |
pola-rs/polars (pinned tag/rev) |
Track latest upstream fixes ahead of crates.io releases |
Note:
[patch.crates-io]forks are stripped oncargo publish, so they only apply to git-checkout builds (CI, local dev, the release workflows).cargo install qsvfrom crates.io is not currently supported.
A fork is a holding action, though — the better outcome is to stop depending on
the problem crate at all. qsv did exactly that with sled, which it had
forked to drop the unmaintained instant (RUSTSEC-2024-0384) and fxhash
(RUSTSEC-2025-0057). Migrating the cached crate to 3.0 swapped its on-disk
backend from sled to redb, so sled and
its fork left the tree entirely rather than being carried indefinitely.
Some advisories are "unmaintained" notices (not vulnerabilities) for crates
that arrive deep in the tree through dependencies qsv does not control. When qsv
cannot upgrade or fork its way out, the advisory is recorded in
.cargo/audit.toml with a comment documenting the dependency chain and the
upstream that must update before the entry can be removed. The list is
re-evaluated periodically and pruned as upstreams migrate.
Current ignores:
| Advisory | Crate | Reaches qsv via | Notes |
|---|---|---|---|
| RUSTSEC-2026-0173 | proc-macro-error2 |
jaq → jiff → defmt (optional) → defmt-macros
|
jiff's defmt feature is never enabled, so it's in Cargo.lock but never compiled or linked (#4072) |
| RUSTSEC-2025-0141 | bincode |
polars → polars-utils
|
Clears when polars updates |
| RUSTSEC-2024-0436 | paste |
tikv-jemalloc-ctl |
Clears when tikv-jemalloc-ctl updates |
| RUSTSEC-2025-0134 | rustls-pemfile |
plotly → plotly_static → webdriver-downloader → reqwest 0.11
|
Clears when plotly's deps move to reqwest 0.12
|
cargo install cargo-audit
cargo audit # honors .cargo/audit.tomlTo see what a given ignored advisory actually pulls in:
cargo tree -i <crate> --target all --all-features