Skip to content
This repository was archived by the owner on Apr 1, 2026. It is now read-only.

fix(deps): update rust crate lru to 0.16.3 [security]#144

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/crate-lru-vulnerability
Open

fix(deps): update rust crate lru to 0.16.3 [security]#144
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/crate-lru-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Jan 7, 2026

This PR contains the following updates:

Package Type Update Change
lru dependencies minor 0.10.00.16.3

GitHub Vulnerability Alerts

GHSA-rhfx-m35p-ff5j

Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.

This invalidates the shared pointer held by the internal HashMap, violating Stacked Borrows rules.


Release Notes

jeromefroe/lru-rs (lru)

v0.16.3

Compare Source

  • Fix Stacked Borrows violation in IterMut.

v0.16.2

Compare Source

  • Upgrade hashbrown dependency to 0.16.0.

v0.16.1

Compare Source

  • Fix Clone for unbounded cache.

v0.16.0

Compare Source

  • Implement Clone for caches with custom hashers.

v0.15.0

Compare Source

  • Return bool from promote and demote to indicate whether key was found.

v0.14.0

Compare Source

  • Use NonZeroUsize::MAX instead of unwrap(), and update MSRV to 1.70.0.

v0.13.0

Compare Source

  • Add peek_mru and pop_mru methods, upgrade dependency on hashbrown to 0.15.2, and update MSRV to 1.65.0.

v0.12.5

Compare Source

  • Upgrade hashbrown dependency to 0.15.

v0.12.4

Compare Source

  • Add methods that take a reference to the key that should be inserted.

v0.12.3

Compare Source

  • Add get_key_value_mut method.

v0.12.2

Compare Source

  • Add clone method.

v0.12.1

Compare Source

  • Add get_key_value method.

v0.12.0

Compare Source

  • Add lifetime specifier to try_get_or_insert_mut.
  • Add BuildHasher trait bound to Debug for LruCache.

v0.11.1

Compare Source

  • Add try_get_or_insert_mut method.

v0.11.0

Compare Source

  • Update dependency on hashbrown to 0.14 and update MSRV to 1.64.0.

v0.10.1

Compare Source

  • Add try_get_or_insert method.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov
Copy link
Copy Markdown

codecov bot commented Jan 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.07%. Comparing base (7676848) to head (18f69dc).

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #144      +/-   ##
==========================================
+ Coverage   85.95%   86.07%   +0.12%     
==========================================
  Files          11       11              
  Lines        4457     4461       +4     
==========================================
+ Hits         3831     3840       +9     
+ Misses        626      621       -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate renovate bot changed the title fix(deps): update rust crate lru to 0.16.3 [security] fix(deps): update rust crate lru to 0.16.3 [security] - autoclosed Mar 27, 2026
@renovate renovate bot closed this Mar 27, 2026
@renovate renovate bot deleted the renovate/crate-lru-vulnerability branch March 27, 2026 02:02
@renovate renovate bot changed the title fix(deps): update rust crate lru to 0.16.3 [security] - autoclosed fix(deps): update rust crate lru to 0.16.3 [security] Mar 30, 2026
@renovate renovate bot reopened this Mar 30, 2026
@renovate renovate bot force-pushed the renovate/crate-lru-vulnerability branch 2 times, most recently from ffa7c25 to 18f69dc Compare March 30, 2026 18:10
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants