From 758d6918c4aec1ec4e188cd5c476663874fa82f5 Mon Sep 17 00:00:00 2001 From: mlevkov Date: Fri, 31 Jul 2026 17:33:28 -0700 Subject: [PATCH] fix(deps): patch RUSTSEC-2026-0204 via crossbeam-epoch 0.9.20 Lockfile-only bump of the transitive crossbeam-epoch (0.9.18 -> 0.9.20), pulled in via the iggy SDK (crossbeam, moka) and metrics-exporter-prometheus (metrics-util). The advisory's invalid pointer dereference lives in fmt::Pointer/Display for Atomic/Shared on null pointers; this crate never formats crossbeam types directly, so exposure was indirect, but the advisory has failed the weekly scheduled audit gate since 2026-07-13. cargo deny check advisories passes locally; 183 lib / 18 model / 1 smoke tests green. Fixes #28 --- CHANGELOG.md | 8 +++++++- Cargo.lock | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index adc5d0d..a756f3a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -Nothing yet. +### Security + +- Bumped transitive `crossbeam-epoch` 0.9.18 -> 0.9.20 (lockfile-only) to + patch RUSTSEC-2026-0204: invalid pointer dereference in the + `fmt::Pointer`/`Display` impls for `Atomic`/`Shared` on null pointers. + Pulled in via the iggy SDK and `metrics-exporter-prometheus`; not used + directly by this crate. ## [0.3.0] - 2026-07-05 diff --git a/Cargo.lock b/Cargo.lock index 5f908db..40c2748 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1125,9 +1125,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ]