chore(deps): bump crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) - #65
Merged
Merged
Conversation
cargo-deny's advisories gate started failing on RUSTSEC-2026-0204 (invalid
pointer dereference in the `fmt::Pointer` impl for crossbeam-epoch's `Atomic`
and `Shared` when the underlying pointer is invalid). It surfaced as a
time-of-check event against the live RUSTSEC DB, not from any dependency change
on our side.
Scope: crossbeam-epoch is a DEV-ONLY transitive dependency
(criterion -> rayon -> rayon-core -> crossbeam-deque -> crossbeam-epoch); it is
not linked into the shipped daemon, so this never affected the release binary —
only the benchmark build and the CI advisories gate.
Fix: a patched release exists inside the current semver range, so this is a
lockfile-only bump (no manifest change, no ignore entry needed):
cargo update -p crossbeam-epoch # 0.9.18 -> 0.9.20
Verification (local, same checks CI runs):
cargo deny --all-features check advisories -> advisories ok (exit 0)
cargo deny --all-features check -> advisories ok, bans ok,
licenses ok, sources ok
cargo check --benches -> Finished (compiles clean)
Affects main as well (the advisory is independent of any branch); landing this
clears the gate for every open PR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-line supply-chain fix. Merge this first — it clears the
advisoriesgate formainand every open PR (including #64), so the README CI badge goes green.What
cargo-deny's advisories gate began failing on RUSTSEC-2026-0204 (invalid pointer dereference incrossbeam-epoch'sfmt::Pointerimpl forAtomic/Shared). It surfaced as a time-of-check event against the live RUSTSEC DB — not from any dependency change on our side — somainfails it right now too.Scope: dev-only, never in the shipped binary
crossbeam-epochis a dev-only transitive dependency:criterion->rayon->rayon-core->crossbeam-deque->crossbeam-epoch. It is not linked into the release daemon, so this never touched the shipped binary — only the benchmark build and the CI gate.Fix: lockfile-only bump
A patched release exists inside the current semver range, so no manifest change and no second
deny.tomlignore entry:One line in
Cargo.lock.Verification (same checks CI runs, locally)
cargo deny --all-features check advisories-> advisories ok (exit 0; was FAILED)cargo deny --all-features check-> advisories ok, bans ok, licenses ok, sources okcargo check --benches-> Finished, compiles clean🤖 Generated with Claude Code