[jratliff79]

Which issue does this PR close?

Relates to RUSTSEC-2026-0391, RUSTSEC-2026-0398 and RUSTSEC-2026-0403.

Rationale for this change

Parquet 55.2 still requires zstd 0.13, so consumers of the 55.x line cannot resolve the patched zstd 0.14.3 / zstd-safe 8.2.0 pair. This proposes a focused maintenance-branch update while preserving the existing Arrow types and codec features.

The advisory bugs are reproducible at the dependency boundary. This does not claim demonstrated plaintext exposure through Parquet's existing fresh-context codec path.

What changes are included?

Raise both normal and development zstd requirements to 0.14.3. Preserve optional/default-feature settings and all codec implementation code. Add two permanent regressions for abandoned encoder/decoder context reuse.

This targets 55_maintenance because a pinned downstream WAL still depends on Parquet 55.x. A release would be needed before that consumer can remove its temporary local overlay. No whole-Arrow advisory clearance is claimed.

Are these changes tested?

The new regressions both fail on the original maintenance source and pass after the dependency change. The complete compression test module passes all eight tests, including the two new regressions. The changed source file passes rustfmt.

Whole-workspace formatting and strict Clippy under Rust 1.96 retain failures in unchanged Arrow files; Clippy stops at lifetime syntax in arrow-buffer. No suppression or unrelated source/CI change is included. Hosted CI and maintainer review remain pending.

Significant user-facing changes

The minimum compression dependency changes; public Parquet APIs, codec availability and format are preserved. Historical stored-file corpus testing and a maintenance release are separate gates.

Prepared with substantial cloud Codex assistance for regression design, implementation, verification and diff review. AI review is separate from maintainer approval.

[Jefffrey]

i dont think we have much appetite for another 55 patch release, considering its over a year old at this point; is it not possible to try upgrade to a more recent version, such as 57 line (which did recently receive a patch release)?

[jratliff79]

Thanks for taking a look and for recommending the 57 line, @Jefffrey. I'll close this 55.x backport proposal and focus on the newer-release upgrade path downstream. Compatibility and security qualification of that upgrade are still in progress.