fix(security): bump lru 0.12 -> 0.18.1 (RUSTSEC-2026-0002) and unblind the deny gate

[h4x0r]

Summary

Fixes RUSTSEC-2026-0002 (lru IterMut violates Stacked Borrows) by widening the caret 0.12 -> 0.18.1, and fixes the deny.toml config that made the advisory invisible to CI in the first place.

Zero source changes — clean build, 483 tests pass.

The advisory

lru's IterMut::next/next_back temporarily create an exclusive reference to the key when dereferencing the internal node pointer, invalidating the shared pointer the internal HashMap still holds. informational = "unsound", patched = [">= 0.16.3"].

Reachability, stated honestly: ewf-core calls only LruCache::{new, get, put, iter} — never iter_mut() — so the unsound path is not reachable from this crate as written. The bump is still right: nothing structurally stops a future caller from reaching for iter_mut, and the affected version should not be in the graph.

The requirement is 0.18.1, not 0.16, because a bare 0.16 caret can still resolve 0.16.0-0.16.2, which are affected.

Both fuzz workspaces carry their own lockfiles and were independently pinned to lru 0.12.5, so the fuzzers were exercising the unsound version. Both are updated.

The gate could not have caught this

The advisory was already in deny.toml's ignore list — but it was never even evaluated.

cargo-deny 0.19.0 defaults unsound to "workspace", then builds the workspace-member set that scope compares against only when the unrelated unmaintained scope is "workspace"/"transitive" (src/advisories.rs:77-93). With unmaintained at its own "all" default, that set is empty, the membership test at line 120 is always false, and every informational = "unsound" advisory hits continue unreported.

Setting unsound = "all" takes the unconditional branch at line 111 — it does not consult that set at all, so it stays correct if upstream fixes the gating. (Setting unmaintained = "workspace" also works, but only as a side effect of populating the set, and would regress the day the bug is fixed.)

Verified empirically against cargo-deny 0.19.0, with the ignore list emptied:

unsound	unmaintained	RUSTSEC-2026-0002 reported?
(default)	unset	no
(default)	all	no
(default)	none	no
(default)	workspace	yes
(default)	transitive	yes
all	unset	yes
workspace	unset	no
transitive	unset	yes
none	unset	no

Proof the gate now fires

Before (caret reverted to lru = "0.12", unsound = "all" in place):

error[unsound]: `IterMut` violates Stacked Borrows by invalidating internal pointer
    ┌─ Cargo.lock:75:1
    │
 75 │ lru 0.12.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0002
    ├ Solution: Upgrade to >=0.16.3 (try `cargo update -p lru`)
    ├ lru v0.12.5
      └── ewf v0.4.7
          ├── ewf-cli v0.3.0
          └── ewf-forensic v0.7.2

advisories FAILED

After:

advisories ok, bans ok, licenses ok, sources ok

Ignore list emptied, not re-homed

Both entries were reported by cargo-deny as advisory-not-detected:

• RUSTSEC-2026-0002 — fixed by this bump.
• RUSTSEC-2025-0056 (adler) — has left the dependency graph entirely.

The prior comment also misattributed RUSTSEC-2026-0002 to console, asserting it was "genuinely fixed" by an indicatif bump that resolved console 0.16.4. The advisory is against lru; console has no RustSec advisory at all, and the "phantom console 0.15 CI re-resolution artifact" it described was not the thing being suppressed.

Downstream

4n6mount consumes the published ewf 0.4.6, whose lru = "0.12" requirement no downstream cargo update can cross. It carries a temporary ignore with an explicit removal condition pointing at this PR (SecurityRonin/4n6mount#11). Once this merges and release-plz publishes ewf >= 0.4.8, cargo update -p ewf there clears it.

Verification

cargo build --workspace --all-features · cargo test --workspace --all-features (483 passed, 5 ignored) · cargo clippy --workspace --all-targets --all-features -- -D warnings · cargo fmt --all --check · cargo deny check

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lru@​0.12.5 ⏵ 0.18.1		+1

View full report