deps: clear RustSec advisories (crossbeam-epoch, anyhow) - #61
Merged
Conversation
`cargo audit` flagged two transitive-dependency advisories: - crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204, error): invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/ `Shared`. Not reachable from undo (we never pointer-format crossbeam atomics), but it is an error-level advisory. - anyhow 1.0.102 -> 1.0.103 (RUSTSEC-2026-0190, unsound warning): unsoundness in `Error::downcast_mut()`. Low practical exposure here. Lockfile-only change; both bumps stay within MSRV 1.85. Verified after update: cargo fmt --check, clippy -D warnings, cargo test --all (217 passed), release build, and cargo audit all clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lockfile-only dependency bumps to clear two
cargo auditadvisories against transitive dependencies:crossbeam-epochanyhowReachability (honest assessment)
Neither advisory is meaningfully reachable from
undo's own code:fmt::Pointerimpl forAtomic/Shared.undonever pointer-formats crossbeam atomics; it's a transitive dep (via the watcher/parallelism stack). Flagged aserrorregardless.Error::downcast_mut().undousesanyhowheavily but does not usedowncast_mut().So this is hygiene / supply-chain cleanliness, not a fix for a live exploit path in
undo.Files touched
Cargo.lockonly (4 lines). No source, noCargo.tomlversion constraints changed. Both bumps stay within MSRV 1.85 (cargo updatelocked to "latest Rust 1.85 compatible versions").Verification (run locally, this branch)
cargo fmt --all --check— cleancargo clippy --all-targets -- -D warnings— cleancargo test --all— 217 passed, 0 failed, 2 ignoredcargo build --release— okcargo audit— clean (exit 0)Note: CI does not currently run
cargo audit; happy to add that gate in a follow-up if wanted.🤖 Generated with Claude Code