fix(security): clear the last vulnerable lru by widening the usb-forensic caret

[h4x0r]

Completes RUSTSEC-2026-0002 for this repo. lru is now 0.16.4 and 0.18.2 — both
at or above the >= 0.16.3 patch line — and the vulnerable 0.12.5 is gone from
the graph.

It took four upstream releases to get here, because the trap was a chain of OUR
OWN crates each declaring a caret one notch below the maintained line:

issen-usb ^0.2 -> usb-forensic ^0.9 -> disk-forensic ^0.3 -> ewf ^0.12 -> lru

Every link was fixed and PUBLISHED first (winevt-carver 0.1.3, ext4fs-core
0.2.8, usb-forensic 0.3.1, plus ewf 0.4.9 earlier), because a fix on a
dependency's main is not a fix for its consumers. This commit is the last link:
issen-usb's own usb-forensic = "0.2".

Two consequences of moving to usb-forensic 0.3.1 had to be resolved, and both
are the same defect in different crates — a requirement looser than the API the
crate actually uses:

usb-forensic 0.3.1  declares peripheral-core "0.8" but uses
                    peripheral_core::shellbag, added in 0.8.2
peripheral-core 0.8.2 uses forensicnomicon_core::usb_vendors, which is
                    newer than the 1.4.0 this lock had resolved

Neither breaks in its own repo, where the lockfile happens to hold a new enough
version. They break in a consumer that unifies on an older patch that still
satisfies the caret. The lock now pins peripheral-core 0.8.2 and
forensicnomicon-core 1.5.1; tightening those declared minimums upstream is
follow-up work, since the manifests are still under-specified.

ratatui is also moved 0.29 -> 0.30 here, which drops its own lru dependency
(ratatui 0.29 required lru ^0.12 and 0.30 requires none).

Verified: 219 test suites pass, fmt and clippy clean under
--workspace --all-targets --all-features, cargo deny check passes all four
sections, cargo vet --locked succeeds with zero self-certified audits.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ext4fs-core@​0.2.6 ⏵ 0.2.8
	disk-forensic@​0.11.0 ⏵ 0.11.4
	crossterm@​0.29.0
	zip-forensic-core@​0.2.1
	dmg-core@​0.1.2 ⏵ 0.1.5	-1
	ewf@​0.4.0 ⏵ 0.4.9	-1
	ratatui@​0.29.0 ⏵ 0.30.2	+1		-1
	usb-forensic@​0.2.0 ⏵ 0.3.1
	winevt-carver@​0.1.2 ⏵ 0.1.3

View full report