Fix the crossbeam-epoch advisory and record the accepted lru one - #9
Merged
Conversation
`cargo audit` reported two findings. They warrant opposite treatment, and conflating them would have shipped a fixable vulnerability in the first release. crossbeam-epoch 0.9.18, reached through jwalk, dereferences an invalid pointer in the `fmt::Pointer` impl for `Atomic` and `Shared` (RUSTSEC-2026-0204). A fix exists within semver, so the lockfile moves to 0.9.20. No source change, no API change. lru 0.12.5, reached through ratatui, is accepted rather than fixed, and .cargo/audit.toml records why. It is an unsoundness rather than a vulnerability: `IterMut::next` and `next_back` briefly take an exclusive reference to the key, violating Stacked Borrows. Vacuum cannot reach it. ratatui uses lru for one purpose, memoising layout splits, and never calls `iter_mut` on that cache; this was checked against the ratatui 0.29.0 sources rather than assumed. Nor can it be fixed in place: ratatui 0.29 requires lru 0.12, the fix landed in 0.16.3, and the only route is the ratatui 0.30 restructure, which is a breaking port of vacuum-tui and vacuum-theme. Rushing that would trade a provably unreachable unsoundness for real instability. The ignore entry states the condition that retires it: ratatui 0.30 makes the layout cache an optional feature, so that migration can drop lru from the tree rather than merely bumping it. Entries in that file are accepted findings carrying their reasoning, not silenced ones; anything unlisted remains a failure to fix. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FCJbPm4FWS99y9utbUe13z
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The accepted-findings list is only useful if something re-reads it. A weekly run, plus a run whenever the dependency set or that list changes, reports new advisories without blocking unrelated work. Deliberately not a pull-request gate: advisories are published against dependencies at arbitrary times, so gating every change on them reddens a pull request for a reason that has nothing to do with it, which trains people to ignore the result. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FCJbPm4FWS99y9utbUe13z
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cargo auditreported two findings. They warrant opposite treatment, and conflating them would have shipped a fixable vulnerability in the first release.Fixed: crossbeam-epoch (RUSTSEC-2026-0204)
Reached through
jwalk. Dereferences an invalid pointer in thefmt::Pointerimpl forAtomicandShared. A fix exists within semver, so the lockfile moves 0.9.18 → 0.9.20. No source change, no API change.Accepted: lru (RUSTSEC-2026-0002)
Reached through
ratatui. Recorded in.cargo/audit.tomlwith the reasoning, rather than silenced:IterMut::next/next_backbriefly take an exclusive reference to the key, violating Stacked Borrows. SeverityINFO, no attacker-facing vector.lrufor exactly one thing — memoising layout splits (LruCache<(Rect, Layout), (Segments, Spacers)>) — and never callsiter_muton that cache. Verified against the ratatui 0.29.0 sources, not assumed.lru = "0.12"; the fix landed in 0.16.3. The only route is the ratatui 0.30 restructure (crate split intoratatui-core/-widgets/-crossterm), a breaking port ofvacuum-tuiandvacuum-theme. Rushing that trades a provably unreachable unsoundness for real instability, which Priority 1 does not permit.The entry states the condition that retires it: ratatui 0.30 makes
layout-cachean optional feature, so that migration can droplrufrom the tree outright rather than merely bumping it.Result
cargo auditgoes from 1 vulnerability to 0, leaving three unmaintained-crate warnings (number_prefix,paste,anyhow). Gate unchanged: fmt, clippy-D warnings, 82 tests,reuse lint.🤖 Generated with Claude Code
https://claude.ai/code/session_01FCJbPm4FWS99y9utbUe13z