fix(deps): widen disk-forensic 0.9 -> 0.11, clearing the vulnerable lru

[h4x0r]

RUSTSEC-2026-0002 — lru's IterMut violating Stacked Borrows, memory-corruption
category, patched in >= 0.16.3. This repo resolved lru 0.12.5 through a chain of
our own crates, each caret-trapped one level below the maintained line:

usb-forensic -> disk-forensic ^0.9 -> ewf ^0.3 -> lru ^0.12

disk-forensic = "0.9" is the trap. disk-forensic 0.11.4 requires ewf "0.4",
and ewf 0.4.9 requires lru 0.18.1, so widening one caret collapses the whole
chain: lru goes 0.12.5 -> 0.18.2 and the vulnerable version leaves the graph.

The lockfile also needed cargo update -p ewf --precise 0.4.9. A plain
cargo update -p ewf is a no-op here — cargo's default update is conservative
and will not cross to a newer patch when the resolved one still satisfies every
requirement. That is worth noting because "cargo update did nothing" reads as
"already current" and is not the same thing.

This is not only issen's problem, but it is issen's blocker: issen reaches this
same lru through issen-usb -> usb-forensic. Publishing this repo is what lets
issen resolve past it, so the fix belongs here rather than in a lockfile pin
downstream.

Verified: 10 test suites pass, fmt and clippy clean, cargo deny check advisories ok, cargo vet --locked succeeds, and the resolved lru is 0.18.2
with no second copy.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	disk-forensic@​0.9.0 ⏵ 0.11.4	-2
	ewf@​0.4.0 ⏵ 0.4.9	-1

View full report