From 1bcae8a84900435e0d483162257576ff9b1e993e Mon Sep 17 00:00:00 2001 From: UnbreakableMJ Date: Fri, 7 Aug 2026 00:29:31 +0300 Subject: [PATCH 1/2] Fix the crossbeam-epoch advisory and record the accepted lru one `cargo audit` reported two findings. They warrant opposite treatment, and conflating them would have shipped a fixable vulnerability in the first release. crossbeam-epoch 0.9.18, reached through jwalk, dereferences an invalid pointer in the `fmt::Pointer` impl for `Atomic` and `Shared` (RUSTSEC-2026-0204). A fix exists within semver, so the lockfile moves to 0.9.20. No source change, no API change. lru 0.12.5, reached through ratatui, is accepted rather than fixed, and .cargo/audit.toml records why. It is an unsoundness rather than a vulnerability: `IterMut::next` and `next_back` briefly take an exclusive reference to the key, violating Stacked Borrows. Vacuum cannot reach it. ratatui uses lru for one purpose, memoising layout splits, and never calls `iter_mut` on that cache; this was checked against the ratatui 0.29.0 sources rather than assumed. Nor can it be fixed in place: ratatui 0.29 requires lru 0.12, the fix landed in 0.16.3, and the only route is the ratatui 0.30 restructure, which is a breaking port of vacuum-tui and vacuum-theme. Rushing that would trade a provably unreachable unsoundness for real instability. The ignore entry states the condition that retires it: ratatui 0.30 makes the layout cache an optional feature, so that migration can drop lru from the tree rather than merely bumping it. Entries in that file are accepted findings carrying their reasoning, not silenced ones; anything unlisted remains a failure to fix. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01FCJbPm4FWS99y9utbUe13z --- .cargo/audit.toml | 36 ++++++++++++++++++++++++++++++++++++ Cargo.lock | 4 ++-- 2 files changed, 38 insertions(+), 2 deletions(-) create mode 100644 .cargo/audit.toml diff --git a/.cargo/audit.toml b/.cargo/audit.toml new file mode 100644 index 0000000..4405873 --- /dev/null +++ b/.cargo/audit.toml @@ -0,0 +1,36 @@ +# SPDX-FileCopyrightText: 2026 Mohamed Hammad +# SPDX-License-Identifier: GPL-3.0-or-later +# +# Configuration for `cargo audit` (Standard section 3.3). +# +# Entries here are ACCEPTED findings, not silenced ones: each carries the +# reasoning that justified accepting it and the condition that would retire it. +# Anything not listed is a genuine failure and must be fixed, not appended. + +[advisories] +ignore = [ + # RUSTSEC-2026-0002 — lru 0.12.5, reached only through ratatui 0.29. + # + # Severity INFO / unsound, not a vulnerability: `IterMut::next` and + # `next_back` briefly take an exclusive reference to the key, violating + # Stacked Borrows. There is no attacker-facing vector, and Vacuum is a + # local tool with no network surface (section 9, privacy-first). + # + # NOT REACHABLE FROM HERE. ratatui uses lru for exactly one thing, its + # layout memoisation cache — `LruCache<(Rect, Layout), (Segments, Spacers)>` + # in src/layout/layout.rs — and never calls `iter_mut` on it. Verified + # against the ratatui 0.29.0 sources, not assumed. + # + # NOT FIXABLE IN PLACE. ratatui 0.29 requires `lru = "0.12.0"`; the fix + # landed in lru 0.16.3, so no `cargo update` reaches it within semver. The + # only route is ratatui 0.30.x, which splits the crate into + # ratatui-core / -widgets / -crossterm and is a breaking port of + # vacuum-tui and vacuum-theme. Doing that hurriedly would trade a + # provably unreachable unsoundness for real instability, which Priority 1 + # does not permit. + # + # RETIRE THIS ENTRY when Vacuum moves to ratatui 0.30. That release makes + # `layout-cache` an optional feature, so the migration can drop lru from + # the dependency tree outright rather than merely bumping it. + "RUSTSEC-2026-0002", +] diff --git a/Cargo.lock b/Cargo.lock index 3cce790..8343680 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -282,9 +282,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] From 371fef94b0ce9aba1fc97c174f0287343b50c72c Mon Sep 17 00:00:00 2001 From: UnbreakableMJ Date: Fri, 7 Aug 2026 00:43:37 +0300 Subject: [PATCH 2/2] Run cargo audit on a schedule rather than as a pull-request gate The accepted-findings list is only useful if something re-reads it. A weekly run, plus a run whenever the dependency set or that list changes, reports new advisories without blocking unrelated work. Deliberately not a pull-request gate: advisories are published against dependencies at arbitrary times, so gating every change on them reddens a pull request for a reason that has nothing to do with it, which trains people to ignore the result. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01FCJbPm4FWS99y9utbUe13z --- .github/workflows/audit.yml | 41 +++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 .github/workflows/audit.yml diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 0000000..ecc04db --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,41 @@ +# SPDX-FileCopyrightText: 2026 Mohamed Hammad +# SPDX-License-Identifier: GPL-3.0-or-later + +name: audit + +# Deliberately NOT a pull-request gate. Advisories are published against +# dependencies at arbitrary times, so running this per PR would redden a change +# for a reason unrelated to it and train everyone to ignore a red tick. A +# schedule reports the same information without blocking unrelated work +# (Standard section 3.3 keeps `cargo audit` a pre-dependency-change step). +on: + schedule: + # Mondays, 07:00 UTC. Times are UTC throughout (section 14). + - cron: "0 7 * * 1" + workflow_dispatch: + # Re-check whenever the dependency set or the accepted-findings list changes. + push: + branches: [main] + paths: + - "Cargo.lock" + - "Cargo.toml" + - "crates/*/Cargo.toml" + - ".cargo/audit.toml" + +jobs: + audit: + name: cargo audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install Rust + run: rustup toolchain install stable --profile minimal + + - name: Install cargo-audit + run: cargo install cargo-audit --locked + + # Accepted findings and the reasoning that justified them live in + # .cargo/audit.toml, which cargo-audit reads from the working directory. + - name: Audit + run: cargo audit