fix(deps): patch lru use-after-free - #74
Merged
Windsor Nguyễn (windsornguyen) merged 1 commit intoAug 12, 2026
Merged
Conversation
Windsor Nguyễn (windsornguyen)
requested review from
annyzhou and
Tsion Kergo (tsiongk)
August 12, 2026 19:37
Dedalus (dedalus-ai)
approved these changes
Aug 12, 2026
Resolves RUSTSEC-2026-0253 (potential use-after-free due to lack of panic safety in LruCache::pop) flagged by the OSV dependency audit. The API surface we use (new, get, put, clear) is unchanged between 0.16.4 and 0.18.2. Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
Windsor Nguyễn (windsornguyen)
force-pushed
the
fix/lru-panic-safety-pr40
branch
from
August 12, 2026 20:07
b35fd48 to
96092c9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #40.
What does this change?
This PR updates
lruto 0.18.2 in both Cargo dependency sets and regenerates both lockfiles.RUSTSEC-2026-0253 reports a panic-safety defect in
LruCache::pop(). The defect can permit use-after-free or double-free from safe Rust. Version 0.18.2 contains the fix.The root workspace continues to use
default-features = false. The Reindeer workspace updates the same direct dependency and removes the unusedhashbrown 0.16.1lock entry. The dependency gate remains enabled.PR #64 applies the same update to the benchmark and Go stack. This PR applies the update directly above #40 without changing that stack.
How was it tested?
OSV Scanner 2.4.0 reported zero actionable vulnerabilities in both lockfiles.
cargo tree -i lru@0.18.2 --locked.cargo -Z bindeps tree --manifest-path tools/build/third-party/rust/Cargo.toml -i lru@0.18.2 --locked.cargo check -p remote_execution --locked.cargo test -p remote_execution --lib --lockedpassed 19 tests.cargo clippy -p remote_execution --lib --no-deps --locked -- -D warnings -A clippy::too-many-arguments -A clippy::single-match../tools/bin/reindeer --third-party-dir tools/build/third-party/rust buckifyproduced no tracked changes.pnpm exec tsc --noEmit.pnpm run ci checkpassed 23 tests and the workflow security checks.pnpm run ci check license.CLA/Vouch check passes, or this PR only updates
VOUCHED.td.Reviewers