From 1cab0b1fc6c145958482c2ce94919e1a39ff005c Mon Sep 17 00:00:00 2001 From: David Monk Date: Tue, 14 Jul 2026 11:23:38 -0400 Subject: [PATCH] deps: bump crossbeam-epoch and anyhow to clear RustSec advisories `cargo audit` flagged two transitive-dependency advisories: - crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204, error): invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/ `Shared`. Not reachable from undo (we never pointer-format crossbeam atomics), but it is an error-level advisory. - anyhow 1.0.102 -> 1.0.103 (RUSTSEC-2026-0190, unsound warning): unsoundness in `Error::downcast_mut()`. Low practical exposure here. Lockfile-only change; both bumps stay within MSRV 1.85. Verified after update: cargo fmt --check, clippy -D warnings, cargo test --all (217 passed), release build, and cargo audit all clean. Co-Authored-By: Claude Opus 4.8 --- Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a76adeb..75af215 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -90,9 +90,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" [[package]] name = "autocfg" @@ -257,9 +257,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ]