Update lru to 0.18.2 - #182

Background

We maintain orbok, a desktop app built on iced. iced renders text through cryoglyph, a fork of this crate, so cargo audit in our CI flagged the advisory below through that path. Checking where the requirement actually lives led here — glyphon has the same one.

The advisory

lru 0.16.x carries RUSTSEC-2026-0253: LruCache::pop() frees the node and drops the key before detaching it from the intrusive list, so a panic in the key's Drop can leave neighbouring nodes pointing at freed memory. Fixed in lru 0.18.2 by detaching first.

glyphon does not appear to be affected

Two independent reasons:

• GlyphonCacheKey is #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]. A Copy type cannot implement Drop, so the key's drop_in_place is a no-op that cannot panic — the advisory's trigger cannot occur.
• pop() is never called. text_atlas.rs uses peek_lru() and pop_lru(), which take a different path.

So this is dependency hygiene rather than a bug fix, and no urgency is implied.

Why it is still worth changing

Anything depending on glyphon inherits the advisory. For projects running cargo audit --deny warnings in CI, that turns the security gate red until an exception is added, regardless of reachability — and because the fix is two majors up, no downstream cargo update can reach it. The requirement has to change here.

On the version string

"0.18.2", not "0.18": lru 0.18.0 and 0.18.1 are published and are not patched. ^0.18 could still resolve to a vulnerable version; ^0.18.2 pins the floor without restricting future 0.18.x.

What we checked

The equivalent one-line change compiles clean against cryoglyph (the iced fork) with no source edits — every lru API it uses is unchanged in 0.18.2. glyphon's usage here is a subset of that (peek_lru, pop_lru), so we expect the same, though we have not compiled glyphon itself against 0.18.2 — worth a CI run rather than taking our word for it.

The same change is open against the iced fork as iced-rs/cryoglyph#5.

(The branch is pushed from nabbisen/cryoglyph because GitHub allows only one fork per network, and we forked cryoglyph first for that PR.)

Happy to close this if you would rather handle it another way.