fix(deps): bump crossbeam-epoch to 0.9.20 for RUSTSEC-2026-0204#193
Closed
andrei-hasna wants to merge 2 commits into
Closed
Conversation
crossbeam-epoch 0.9.18 is affected by RUSTSEC-2026-0204 (fmt::Pointer deref of a null Atomic/Shared can crash), which fails the cargo-deny advisories check in CI. Bump to the patched 0.9.20 via a semver-compatible lockfile update (satisfies the ^0.9.17 and ^0.9.18 requirements from crossbeam-deque and moka) and repin MODULE.bazel.lock to match. No advisory suppression. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restores the cargo-deny CI advisories check by addressing RUSTSEC-2026-0204 for
crossbeam-epoch0.9.18.crossbeam-epoch0.9.18 is affected by RUSTSEC-2026-0204 (afmt::Pointerderef of a nullAtomic/Sharedcan crash). It is pulled transitively viacrossbeam-deque0.8.6 (^0.9.17) andmoka0.12.13 (^0.9.18). Both requirements are satisfied by the patched 0.9.20 (published 2026-07-06), so this is a semver-compatible lockfile update — no advisory suppression.Changes
codex-rs/Cargo.lock: bumpcrossbeam-epoch0.9.18 → 0.9.20 (version + checksum only; no other dependency churn; still a singlecrossbeam-epochversion).MODULE.bazel.lock: repinned to match the new Cargo.lock (singlecrossbeam-epoch_0.9.18→_0.9.20metadata entry).Validation
cargo update -p crossbeam-epoch --precise 0.9.20→ updated 0.9.18 → 0.9.20cargo deny --manifest-path codex-rs/Cargo.toml check advisories→advisories ok(RUSTSEC-2026-0204 no longer fails; no new advisory regressions)bazel mod deps --lockfile_mode=update→ regenerated MODULE.bazel.lockbazel mod deps --lockfile_mode=error(CI up-to-date check) → exit 0Evidence
Observed failure: cargo-deny GitHub Actions run 28890588535 job 85701964276 on 2026-07-07 — advisories FAILED on RUSTSEC-2026-0204 affecting crossbeam-epoch 0.9.18.
🤖 Generated with Claude Code