Skip to content

chore(deps): fix pointer-deref advisory on crossbeam-epoch 0.9.19 - #646

Merged
twitchyliquid64 merged 1 commit into
mainfrom
tom/progress
Jul 6, 2026
Merged

chore(deps): fix pointer-deref advisory on crossbeam-epoch 0.9.19#646
twitchyliquid64 merged 1 commit into
mainfrom
tom/progress

Conversation

@twitchyliquid64

@twitchyliquid64 twitchyliquid64 commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Member 
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
    ┌─ /github/workspace/Cargo.lock:111:1
    │
111 │ crossbeam-epoch 0.9.19 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0204
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
    ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
    ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
    ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
    ├ crossbeam-epoch v0.9.19
      ├── crossbeam-deque v0.8.7
      │   └── rayon-core v1.13.0
      │       └── rayon v1.12.0
      │           ├── mip v0.4.1
      │           ├── op v0.0.1
      │           │   ├── check v0.0.1
      │           │   │   ├── mctx v0.0.1
      │           │   │   │   ├── minimald v0.0.1
      │           │   │   │   └── mip v0.4.1 (*)
      │           │   │   ├── minimald v0.0.1 (*)
      │           │   │   ├── mip v0.4.1 (*)
      │           │   │   └── remote-client v0.0.1
      │           │   │       └── mip v0.4.1 (*)
      │           │   ├── mctx v0.0.1 (*)
      │           │   ├── minimald v0.0.1 (*)
      │           │   ├── mip v0.4.1 (*)
      │           │   └── orchestrator v0.0.1
      │           │       ├── mctx v0.0.1 (*)
      │           │       ├── mip v0.4.1 (*)
      │           │       └── remote-client v0.0.1 (*)
      │           └── topiary-core v0.7.3
      │               └── nickel-lang-core v0.17.0
      │                   ├── args v0.0.1
      │                   │   ├── common v0.0.1
      │                   │   │   ├── check v0.0.1 (*)
      │                   │   │   ├── checkouts v0.0.1
      │                   │   │   │   ├── graph v0.0.1
      │                   │   │   │   │   ├── check v0.0.1 (*)
      │                   │   │   │   │   ├── lcache v0.0.1
      │                   │   │   │   │   │   ├── check v0.0.1 (*)
      │                   │   │   │   │   │   ├── mctx v0.0.1 (*)
      │                   │   │   │   │   │   ├── mip v0.4.1 (*)
      │                   │   │   │   │   │   ├── op v0.0.1 (*)
      │                   │   │   │   │   │   ├── orchestrator v0.0.1 (*)
      │                   │   │   │   │   │   └── rcache v0.0.1
      │                   │   │   │   │   │       ├── mctx v0.0.1 (*)
      │                   │   │   │   │   │       ├── mip v0.4.1 (*)
      │                   │   │   │   │   │       └── orchestrator v0.0.1 (*)
      │                   │   │   │   │   ├── mctx v0.0.1 (*)
      │                   │   │   │   │   ├── minimald v0.0.1 (*)
      │                   │   │   │   │   ├── mip v0.4.1 (*)
      │                   │   │   │   │   ├── op v0.0.1 (*)
      │                   │   │   │   │   ├── orchestrator v0.0.1 (*)
      │                   │   │   │   │   ├── rcache v0.0.1 (*)
      │                   │   │   │   │   └── remote-client v0.0.1 (*)
      │                   │   │   │   ├── mctx v0.0.1 (*)
      │                   │   │   │   └── mip v0.4.1 (*)
      │                   │   │   ├── decode v0.0.1
      │                   │   │   │   ├── check v0.0.1 (*)
      │                   │   │   │   ├── graph v0.0.1 (*)
      │                   │   │   │   ├── mip v0.4.1 (*)
      │                   │   │   │   ├── op v0.0.1 (*)
      │                   │   │   │   └── orchestrator v0.0.1 (*)
      │                   │   │   ├── graph v0.0.1 (*)
      │                   │   │   ├── lcache v0.0.1 (*)
      │                   │   │   ├── mctx v0.0.1 (*)
      │                   │   │   ├── mfile v0.0.1
      │                   │   │   │   ├── checkouts v0.0.1 (*)
      │                   │   │   │   ├── decode v0.0.1 (*)
      │                   │   │   │   ├── graph v0.0.1 (*)
      │                   │   │   │   ├── mctx v0.0.1 (*)
      │                   │   │   │   ├── minimald v0.0.1 (*)
      │                   │   │   │   ├── mip v0.4.1 (*)
      │                   │   │   │   └── op v0.0.1 (*)
      │                   │   │   ├── minimald v0.0.1 (*)
      │                   │   │   ├── mip v0.4.1 (*)
      │                   │   │   ├── op v0.0.1 (*)
      │                   │   │   ├── orchestrator v0.0.1 (*)
      │                   │   │   ├── rcache v0.0.1 (*)
      │                   │   │   ├── remote-client v0.0.1 (*)
      │                   │   │   ├── sandbox2 v0.0.1
      │                   │   │   │   ├── mctx v0.0.1 (*)
      │                   │   │   │   ├── minimald v0.0.1 (*)
      │                   │   │   │   ├── op v0.0.1 (*)
      │                   │   │   │   └── orchestrator v0.0.1 (*)
      │                   │   │   └── sessions v0.0.1
      │                   │   │       ├── minimal v0.0.1
      │                   │   │       ├── minimald v0.0.1 (*)
      │                   │   │       ├── minimald-rpc v0.0.1
      │                   │   │       │   ├── minimal v0.0.1 (*)
      │                   │   │       │   ├── minimald v0.0.1 (*)
      │                   │   │       │   └── minvmd v0.0.1
      │                   │   │       │       └── minimal v0.0.1 (*)
      │                   │   │       ├── (dev) minvmd v0.0.1 (*)
      │                   │   │       └── sandbox2 v0.0.1 (*)
      │                   │   ├── decode v0.0.1 (*)
      │                   │   ├── graph v0.0.1 (*)
      │                   │   ├── mctx v0.0.1 (*)
      │                   │   ├── mfile v0.0.1 (*)
      │                   │   ├── minimald v0.0.1 (*)
      │                   │   └── mip v0.4.1 (*)
      │                   ├── check v0.0.1 (*)
      │                   ├── common v0.0.1 (*)
      │                   ├── decode v0.0.1 (*)
      │                   ├── graph v0.0.1 (*)
      │                   └── mip v0.4.1 (*)
      └── moka v0.12.15
          └── check v0.0.1 (*)

@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7f48c307-df84-4652-aa60-36423de63f43

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@twitchyliquid64
twitchyliquid64 enabled auto-merge (squash) July 6, 2026 22:33
@twitchyliquid64 twitchyliquid64 mentioned this pull request Jul 6, 2026
Merged
@twitchyliquid64
twitchyliquid64 merged commit ef85246 into main Jul 6, 2026
39 checks passed
@twitchyliquid64
twitchyliquid64 deleted the tom/progress branch July 6, 2026 22:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@norrietaylor norrietaylor norrietaylor approved these changes
@0chroma 0chroma Awaiting requested review from 0chroma
@evanspearman evanspearman Awaiting requested review from evanspearman
@msample msample Awaiting requested review from msample

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@twitchyliquid64 @norrietaylor