From f43762433118dce33c8405dd6e83ca954e6a8a25 Mon Sep 17 00:00:00 2001 From: Benjamin Demaille Date: Sat, 29 Aug 2026 14:37:31 +0200 Subject: [PATCH] fix(deps): bump crossbeam-epoch to 0.9.20 for RUSTSEC-2026-0204 cargo audit fails on main: crossbeam-epoch 0.9.18 carries RUSTSEC-2026-0204, an invalid pointer dereference in the fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid. It arrives transitively through rayon. A lockfile bump to 0.9.20 is the advisory's own recommended fix and touches nothing else: 95 other dependencies are unchanged and the suite is unaffected. The four remaining advisories are the ones the workflow already tolerates. Co-Authored-By: Claude Opus 5 (1M context) --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index da20215e..364fb55a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -385,9 +385,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ]