fix(security): refresh the lock so lru reaches the patched line (RUSTSEC-2026-0002) - #13
Merged
Conversation
…SEC-2026-0002) lru's `IterMut` violates Stacked Borrows — RUSTSEC-2026-0002, categorised memory-corruption, patched in >= 0.16.3 and unaffected below 0.9.0. This repo resolved a version inside the affected window. No manifest here declares lru. It arrives through `ewf`, which is the only crate in the fleet that depends on it directly, so the fix belonged upstream and was made there: ewf 0.4.9 requires lru 0.18.1. This commit is only the lockfile catching up — the requirement on `ewf` already permitted it, so nothing but the resolution moves. That is worth stating because it is the difference between a real fix and a suppression: nothing is being ignored or exempted here, and no advisory entry is added anywhere. The vulnerable code simply stops being resolved. Verified by resolution rather than assumption: `cargo update` is run and the resulting Cargo.lock is checked to name an lru at or above 0.16.3 before this commit is made.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Refreshing the lock to clear RUSTSEC-2026-0002 moved several crates to versions
this store had no record for. Each takes the strongest mechanism that applies,
per ADR-0018, rather than one blanket sweep:
ours, from crates.io -> `cargo vet trust <crate> h4x0r`. A trust entry keys
on the publisher, so it survives our next release
instead of going stale with the version.
third-party -> [[exemptions]], the honest floor for code no
imported aggregate auditor covers.
`cargo vet certify --accept-all` was not used anywhere: a certify record asserts
a human read the source, so bulk-certifying would fabricate exactly the
condition being claimed.
`cargo vet --locked` passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
lru's
IterMutviolates Stacked Borrows — RUSTSEC-2026-0002, categorisedmemory-corruption, patched in >= 0.16.3 and unaffected below 0.9.0. This repo
resolved a version inside the affected window.
No manifest here declares lru. It arrives through
ewf, which is the only cratein the fleet that depends on it directly, so the fix belonged upstream and was
made there: ewf 0.4.9 requires lru 0.18.1. This commit is only the lockfile
catching up — the requirement on
ewfalready permitted it, so nothing but theresolution moves.
That is worth stating because it is the difference between a real fix and a
suppression: nothing is being ignored or exempted here, and no advisory entry is
added anywhere. The vulnerable code simply stops being resolved.
Verified by resolution rather than assumption:
cargo updateis run and theresulting Cargo.lock is checked to name an lru at or above 0.16.3 before this
commit is made.