From e3f8d055d5605fe47705452079da92c99aef41e0 Mon Sep 17 00:00:00 2001
From: Albert Hui <i@hack9u.online>
Date: Mon, 17 Aug 2026 00:46:00 +0000
Subject: [PATCH 1/2] fix(security): update ewf to 0.4.10 to clear
 RUSTSEC-2026-0253
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`lru 0.12.5` reached this repo transitively through `ewf 0.4.7`, which declares
`lru ^0.12`. ewf 0.4.9 onward declares `^0.18.1`, so taking 0.4.10 drops the
vulnerable copy: the graph now resolves a single `lru 0.18.2`.

RUSTSEC-2026-0253 is an unsoundness in `LruCache::pop()` — a panicking key
`Drop` skips `detach()`, leaving dangling pointers that a later eviction writes
through (CWE-416/415, reachable from safe Rust).

Lockfile only. The declared requirement `ewf = { version = "0.4", optional =
true }` already admitted 0.4.10, so nothing in the manifest moves — the lock was
simply pinned to a release that predates the fix.
---
 Cargo.lock | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 95e733d..b9d71c9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2292,17 +2292,18 @@ dependencies = [
 
 [[package]]
 name = "ewf"
-version = "0.4.7"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f0aae36d49a5b16a1353b4b80f7d0090666ca19dd910aed7b0ab1d35bf8f60"
+checksum = "d28735206fd9d022cc1fba6a686f9c8a64f2561f4e5ae8b7f08da3528bf7594d"
 dependencies = [
  "adler2",
  "flate2",
  "glob",
  "log",
- "lru 0.12.5",
+ "lru",
  "md-5",
  "rayon",
+ "safe-read",
  "sha-1",
  "thiserror 2.0.18",
 ]
@@ -2916,8 +2917,6 @@ version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "allocator-api2",
- "equivalent",
  "foldhash 0.1.5",
  "serde",
 ]
@@ -4013,15 +4012,6 @@ dependencies = [
  "logos-codegen",
 ]
 
-[[package]]
-name = "lru"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
-dependencies = [
- "hashbrown 0.15.5",
-]
-
 [[package]]
 name = "lru"
 version = "0.18.2"
@@ -5559,7 +5549,7 @@ dependencies = [
  "hashbrown 0.17.0",
  "itertools",
  "kasuari",
- "lru 0.18.2",
+ "lru",
  "palette",
  "serde",
  "strum 0.28.0",
@@ -6078,6 +6068,12 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "safe-read"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67fa5cb4ac7edaf64ee1843699d72fb9c72b52411d4ec5e7142340be61ce6c09"
+
 [[package]]
 name = "salsa20"
 version = "0.10.2"

From be05dbfe058c9f4afe156706a105b2c2eacc3dc3 Mon Sep 17 00:00:00 2001
From: Albert Hui <i@hack9u.online>
Date: Mon, 24 Aug 2026 10:26:46 +0800
Subject: [PATCH 2/2] chore(vet): cache publisher records for ewf 0.4.10 and
 safe-read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cargo vet --locked verifies [[trusted]] entries against publisher records
cached in imports.lock, and neither new version was recorded:

  ewf:0.4.10 missing ["safe-to-deploy"]
  safe-read:0.2.2 missing ["safe-to-deploy"]

Both are first-party with existing trust entries (h4x0r, user-id 347968;
ewf from 2026-03-05, safe-read from 2026-07-15). No trust entry is added
here — only the publisher records they verify against.

safe-read is NEW to this graph rather than a version bump: ewf 0.4.10
replaced its lru usage with safe-read, which is the same change that
clears RUSTSEC-2026-0253. Normally a new crate entering the graph is a
supply-chain decision rather than bookkeeping; here the decision predates
the PR by a month and the crate is our own, so the standing trust covers
it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 supply-chain/imports.lock | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
index 2345439..641ccb2 100644
--- a/supply-chain/imports.lock
+++ b/supply-chain/imports.lock
@@ -123,8 +123,8 @@ user-login = "nical"
 user-name = "Nicolas Silva"
 
 [[publisher.ewf]]
-version = "0.4.7"
-when = "2026-07-25"
+version = "0.4.10"
+when = "2026-08-08"
 user-id = 347968
 user-login = "h4x0r"
 user-name = "Albert Hui"
@@ -166,6 +166,13 @@ user-id = 3726
 user-login = "cfallin"
 user-name = "Chris Fallin"
 
+[[publisher.safe-read]]
+version = "0.2.2"
+when = "2026-08-06"
+user-id = 347968
+user-login = "h4x0r"
+user-name = "Albert Hui"
+
 [[publisher.unicode-normalization]]
 version = "0.1.25"
 when = "2025-10-30"