Today — #4 (thrift CVE-2026-43868 via parquet 58) is blocked on a Ballista release for DataFusion 55. Upstream state on 2026-09-13: Ballista's newest release is 54.1.0 (2026-08-09, datafusion ^54); Ballista git main already has datafusion = "55", arrow = "59.2.0", rust-version = "1.94.0"; the tracking issue apache/datafusion-ballista#2369 "Ballista 55.0.0 Release" is open with PRs still in review. Recent cadence (52→53→54: 2026-03-07, 05-25, 07-15) puts 55 at roughly late September to October 2026. datafusion 55.1.0, arrow/parquet 59.3.0 (no thrift) and object_store 0.14.1 are already published. cargo deny check advisories today warns GHSA-2f9f-gq7v-9h6m is an unknown advisory: RustSec has not imported it, so the deny.toml ignore is currently a no-op and untested.
Why it is worth preparing — the bump is the largest dependency event of the next version: arrow 58→59, parquet 58→59, datafusion 54→55, possibly object_store 0.13→0.14, an MSRV move, and — because ADR-0009 makes DataFusion the public vocabulary — a breaking release of all nine crates. Discovering the API breaks the day Ballista 55 ships is the expensive order.
Fix — a chain/ballista-55 branch (never merged while it points at git: deny.toml forbids git sources) that pins Ballista main by commit, fixes every compile error in the codec, placement rule and UDF registration, and runs the full gate. Record the diff size and the API changes in an issue comment. When 55.0.0 lands: switch the pin to the release, run make coherence, remove the GHSA-2f9f-gq7v-9h6m ignore and SECURITY.md's known-advisory entry (#4's done-when), ship as a minor.
Done when — the branch builds green against Ballista main; a comment on #4 records the expected breaks; the bump lands within one week of Ballista 55.0.0 on crates.io.
Today — #4 (thrift CVE-2026-43868 via parquet 58) is blocked on a Ballista release for DataFusion 55. Upstream state on 2026-09-13: Ballista's newest release is 54.1.0 (2026-08-09,
datafusion ^54); Ballista git main already hasdatafusion = "55",arrow = "59.2.0",rust-version = "1.94.0"; the tracking issue apache/datafusion-ballista#2369 "Ballista 55.0.0 Release" is open with PRs still in review. Recent cadence (52→53→54: 2026-03-07, 05-25, 07-15) puts 55 at roughly late September to October 2026. datafusion 55.1.0, arrow/parquet 59.3.0 (no thrift) and object_store 0.14.1 are already published.cargo deny check advisoriestoday warnsGHSA-2f9f-gq7v-9h6mis an unknown advisory: RustSec has not imported it, so thedeny.tomlignore is currently a no-op and untested.Why it is worth preparing — the bump is the largest dependency event of the next version: arrow 58→59, parquet 58→59, datafusion 54→55, possibly object_store 0.13→0.14, an MSRV move, and — because ADR-0009 makes DataFusion the public vocabulary — a breaking release of all nine crates. Discovering the API breaks the day Ballista 55 ships is the expensive order.
Fix — a
chain/ballista-55branch (never merged while it points at git:deny.tomlforbids git sources) that pins Ballista main by commit, fixes every compile error in the codec, placement rule and UDF registration, and runs the full gate. Record the diff size and the API changes in an issue comment. When 55.0.0 lands: switch the pin to the release, runmake coherence, remove theGHSA-2f9f-gq7v-9h6mignore and SECURITY.md's known-advisory entry (#4's done-when), ship as a minor.Done when — the branch builds green against Ballista main; a comment on #4 records the expected breaks; the bump lands within one week of Ballista 55.0.0 on crates.io.