From 7bf7d22a94e3bcb97a4dbcc350ef1f7a88885adf Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 15 Jul 2026 01:40:42 +0000 Subject: [PATCH] fix(security): bump crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolve a única vulnerabilidade que falha o job 'cargo audit' no CI: invalid pointer dereference no impl fmt::Pointer de Atomic/Shared (RUSTSEC-2026-0204). Correção do advisory: upgrade para >=0.9.20. Alteração restrita ao Cargo.lock (dependência transitiva; sem mudança de Cargo.toml nem de API). Os demais achados do audit (bincode unmaintained RUSTSEC-2025-0141, anyhow unsound RUSTSEC-2026-0190) são warnings e não falham o audit padrao. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_019wEuw8HPQaDLGqfFQoNUQ4 --- rust/Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/Cargo.lock b/rust/Cargo.lock index 1d520822..2d8297d3 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -1344,9 +1344,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ]