Repository navigation
chore(deps): bump ringbuf 0.5.0 -> 0.5.2 for RUSTSEC-2026-0293 - #21
Merged
Merged
Conversation
RUSTSEC-2026-0293 is a double free / use-after-free in ringbuf's Consumer::skip and Consumer::clear when an element's Drop panics; fixed in 0.5.2. ringbuf is a transitive dep via rawb-io, which uses only a HeapRb<u8> — u8 has no Drop, so the vulnerable path is unreachable here. The lockfile bump clears the weekly cargo-deny advisories check.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Relock
ringbuf0.5.0 → 0.5.2 (cargo update -p ringbuf).Cargo.lockonly; 0.5.2 is compatible with our MSRV (1.89).Why CI on
mainwent redThe scheduled cargo-deny
advisoriescheck has failed weekly since 2026-09-21 with:No code or lockfile change on our side — the advisory was published against the existing lock. Fixed upstream in ringbuf 0.5.2 (agerasev/ringbuf#60).
Impact on dupblaster
None in practice.
ringbufcomes in transitively viarawb-io(ringbuf → rawb-io → dupblaster), which uses only aHeapRb<u8>. The bug needs an element whoseDroppanics;u8has noDrop, so the path is unreachable.Verification
cargo deny check→advisories ok, bans ok, licenses ok, sources okcargo ci-fmt,ci-lint,ci-test(373 passed),ci-docall passRelock with no user-visible effect → no CHANGELOG entry.