Affected components
crates/arrowhead-cli TUI/status surfaces- Workspace dependency
ratatui = 0.28.0 in Cargo.toml
- Transitive
lru 0.12.5 via ratatui 0.28.1
Risk
cargo audit reports RUSTSEC-2026-0002 for lru 0.12.5 (IterMut stacked-borrows unsoundness). The dependency is pulled by ratatui, not used directly by Arrowhead.
Impact
The current audit result is a warning, but it keeps dependency health noisy and could become release-blocking if policy changes. The fix likely requires a ratatui upgrade from 0.28.x to 0.30.x and possible TUI API adjustments.
Proposed fix
Upgrade ratatui to the latest compatible release, adapt CLI/TUI code for any API changes, and verify terminal status rendering still works.
Suggested tests
cargo fmt --allcargo check --all-targetscargo clippy --all-targets -- -D warningscargo test --all-targets -- --nocapture- Manual or automated smoke of
arrowhead index status TUI rendering
cargo audit confirms the lru warning is gone
Why not implemented automatically
This is a UI dependency major/minor upgrade with possible rendering/API changes. It is broader than a low-risk biweekly maintenance edit and needs focused TUI validation.
Affected components
crates/arrowhead-cliTUI/status surfacesratatui = 0.28.0inCargo.tomllru 0.12.5viaratatui 0.28.1Risk
cargo auditreports RUSTSEC-2026-0002 forlru 0.12.5(IterMutstacked-borrows unsoundness). The dependency is pulled byratatui, not used directly by Arrowhead.Impact
The current audit result is a warning, but it keeps dependency health noisy and could become release-blocking if policy changes. The fix likely requires a
ratatuiupgrade from 0.28.x to 0.30.x and possible TUI API adjustments.Proposed fix
Upgrade
ratatuito the latest compatible release, adapt CLI/TUI code for any API changes, and verify terminal status rendering still works.Suggested tests
cargo fmt --allcargo check --all-targetscargo clippy --all-targets -- -D warningscargo test --all-targets -- --nocapturearrowhead index statusTUI renderingcargo auditconfirms thelruwarning is goneWhy not implemented automatically
This is a UI dependency major/minor upgrade with possible rendering/API changes. It is broader than a low-risk biweekly maintenance edit and needs focused TUI validation.