Skip to content

chore(deps): bump crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) - #65

Merged
tattoosonmyskin merged 1 commit into
mainfrom
chore/rustsec-2026-0204-crossbeam
Jul 16, 2026
Merged

chore(deps): bump crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204)#65
tattoosonmyskin merged 1 commit into
mainfrom
chore/rustsec-2026-0204-crossbeam

Conversation

@tattoosonmyskin

Copy link
Copy Markdown
Contributor

One-line supply-chain fix. Merge this first — it clears the advisories gate for main and every open PR (including #64), so the README CI badge goes green.

What

cargo-deny's advisories gate began failing on RUSTSEC-2026-0204 (invalid pointer dereference in crossbeam-epoch's fmt::Pointer impl for Atomic/Shared). It surfaced as a time-of-check event against the live RUSTSEC DB — not from any dependency change on our side — so main fails it right now too.

Scope: dev-only, never in the shipped binary

crossbeam-epoch is a dev-only transitive dependency: criterion -> rayon -> rayon-core -> crossbeam-deque -> crossbeam-epoch. It is not linked into the release daemon, so this never touched the shipped binary — only the benchmark build and the CI gate.

Fix: lockfile-only bump

A patched release exists inside the current semver range, so no manifest change and no second deny.toml ignore entry:

cargo update -p crossbeam-epoch   # 0.9.18 -> 0.9.20

One line in Cargo.lock.

Verification (same checks CI runs, locally)

  • cargo deny --all-features check advisories -> advisories ok (exit 0; was FAILED)
  • cargo deny --all-features check -> advisories ok, bans ok, licenses ok, sources ok
  • cargo check --benches -> Finished, compiles clean

🤖 Generated with Claude Code

cargo-deny's advisories gate started failing on RUSTSEC-2026-0204 (invalid
pointer dereference in the `fmt::Pointer` impl for crossbeam-epoch's `Atomic`
and `Shared` when the underlying pointer is invalid). It surfaced as a
time-of-check event against the live RUSTSEC DB, not from any dependency change
on our side.

Scope: crossbeam-epoch is a DEV-ONLY transitive dependency
(criterion -> rayon -> rayon-core -> crossbeam-deque -> crossbeam-epoch); it is
not linked into the shipped daemon, so this never affected the release binary —
only the benchmark build and the CI advisories gate.

Fix: a patched release exists inside the current semver range, so this is a
lockfile-only bump (no manifest change, no ignore entry needed):
  cargo update -p crossbeam-epoch   # 0.9.18 -> 0.9.20

Verification (local, same checks CI runs):
  cargo deny --all-features check advisories  -> advisories ok (exit 0)
  cargo deny --all-features check             -> advisories ok, bans ok,
                                                 licenses ok, sources ok
  cargo check --benches                       -> Finished (compiles clean)

Affects main as well (the advisory is independent of any branch); landing this
clears the gate for every open PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 16, 2026 01:47

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@tattoosonmyskin
tattoosonmyskin merged commit 72b3b3f into main Jul 16, 2026
10 checks passed
@tattoosonmyskin
tattoosonmyskin deleted the chore/rustsec-2026-0204-crossbeam branch July 16, 2026 01:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants