fix(security): ratatui 0.29 -> 0.30 removes the lru dependency (RUSTSEC-2026-0002)

[h4x0r]

RUSTSEC-2026-0002 — lru's IterMut violating Stacked Borrows, categorised
memory-corruption, patched in >= 0.16.3. This repo resolved lru 0.12.5.

The source is not one of ours, which is why refreshing locks never cleared it:

ratatui 0.29.0  requires  lru ^0.12.0

That caret cannot reach 0.16.3, so no cargo update anywhere downstream could
escape it. ratatui 0.30 dropped the lru dependency outright — the crate has zero
lru mentions in its manifest — so the fix removes the vulnerable code from the
graph rather than upgrading it.

Found by reading cargo metadata's resolve graph rather than the lockfile.
cargo tree -i lru printed nothing here, which looks like "not a dependency"
and is not: lru was present in metadata with no host-target dependent, and only
the resolve graph named ratatui as the requiring package. A lockfile-level scan
says which vulnerable versions exist; it does not say who pinned them.

Worth recording for the rest of the sweep: an earlier pass concluded ewf was
the only crate declaring lru. That was measured by grepping OUR manifests only,
so it missed every third-party declarer. ewf was A source, not THE source.

Verified: 15 test suites pass, clippy and fmt clean, cargo deny check advisories ok, cargo vet --locked succeeds, and the resolved lru is 0.18.2.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​ratatui@​0.29.0 ⏵ 0.30.2	+1		-1

View full report