Skip to content

fix(deps): bump crossbeam-epoch to 0.9.20 - #660

Merged
jdrouet merged 1 commit into
mainfrom
fix/crossbeam-epoch-rustsec-2026-0204
Jul 30, 2026
Merged

fix(deps): bump crossbeam-epoch to 0.9.20#660
jdrouet merged 1 commit into
mainfrom
fix/crossbeam-epoch-rustsec-2026-0204

Conversation

@jdrouet

@jdrouet jdrouet commented Jul 30, 2026

Copy link
Copy Markdown
Owner

Bumps crossbeam-epoch from 0.9.18 to 0.9.20 in Cargo.lock.

Why

The security audit job is failing on RUSTSEC-2026-0204invalid pointer dereference in the fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid. Patched in >= 0.9.20.

crossbeam-epoch is pulled in transitively via crossbeam-deque, so the advisory fails the audit job on main and on every dependency PR — that is what is currently blocking #659, which is otherwise unrelated to this crate.

Lockfile-only change: cargo update -p crossbeam-epoch.

Verification

  • cargo build --workspace --all-features — passes
  • cargo test --workspace --all-features — passes

Fixes RUSTSEC-2026-0204: invalid pointer dereference in the fmt::Pointer
impl for Atomic and Shared when the underlying pointer is invalid.
crossbeam-epoch reaches the workspace transitively through
crossbeam-deque, and the advisory was failing the security audit job on
main and on every dependency PR.

Signed-off-by: Jeremie Drouet <jeremie.drouet@gmail.com>
@jdrouet-datadog-monitor

Copy link
Copy Markdown

Pipelines

⚠️ Warnings

🚦 1 Pipeline job failed

security audit | security_audit   View in Datadog   GitHub Actions

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: e76fa26 | Docs | Datadog PR Page | Give us feedback!

@github-actions

Copy link
Copy Markdown
Contributor

📈 This is how your metrics evolved 📉


@jdrouet

jdrouet commented Jul 30, 2026

Copy link
Copy Markdown
Owner Author

Merging with security_audit red on purpose. The audit reports one advisory at a time, and there are currently two outstanding:

So neither PR can be green on its own: before this change the audit stopped at crossbeam-epoch, and with it applied the audit gets one step further and stops at quinn-proto. Landing this and then #659 leaves main audit-clean. security_audit is not a required check, and every other check here passes.

@jdrouet
jdrouet merged commit a0c0795 into main Jul 30, 2026
18 of 20 checks passed
@jdrouet
jdrouet deleted the fix/crossbeam-epoch-rustsec-2026-0204 branch July 30, 2026 08:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant