chore(rust): remove stale RUSTSEC-2026-0002 ignore#19598
Merged
Conversation
The lru crate advisory (RUSTSEC-2026-0002) no longer matches any crate in the dependency tree, causing cargo-deny to fail with "advisory was not encountered". The vulnerable lru versions (0.9.0–0.16.2) have been patched — lru 0.16.3 is already in Cargo.lock. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #19598 +/- ##
===========================================
Coverage 75.5% 75.5%
===========================================
Files 675 481 -194
Lines 71562 60286 -11276
===========================================
- Hits 54071 45566 -8505
+ Misses 17347 14720 -2627
+ Partials 144 0 -144
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
lz4_flex 0.12.0 suffers from RUSTSEC-2026-0041 https://rustsec.org/advisories/RUSTSEC-2026-0041
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension. |
wwared
approved these changes
Mar 17, 2026
Contributor
wwared
left a comment
wwared
left a comment
There was a problem hiding this comment.
Updated lz4_flex due to the following cargo-deny error:
├ ID: RUSTSEC-2026-0041
├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0041
├ Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer.
github-merge-queue
bot
removed this pull request from the merge queue due to no response for status checks
ClaytonNorthey92
pushed a commit
to hemilabs/optimism
that referenced
this pull request
Mar 19, 2026
…#19598) * chore(rust): remove stale RUSTSEC-2026-0002 ignore from deny.toml The lru crate advisory (RUSTSEC-2026-0002) no longer matches any crate in the dependency tree, causing cargo-deny to fail with "advisory was not encountered". The vulnerable lru versions (0.9.0–0.16.2) have been patched — lru 0.16.3 is already in Cargo.lock. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: Update lz4_flex to 0.12.1 lz4_flex 0.12.0 suffers from RUSTSEC-2026-0041 https://rustsec.org/advisories/RUSTSEC-2026-0041 --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: wwared <541936+wwared@users.noreply.github.com>
ClaytonNorthey92
pushed a commit
to hemilabs/optimism
that referenced
this pull request
Mar 23, 2026
…#19598) * chore(rust): remove stale RUSTSEC-2026-0002 ignore from deny.toml The lru crate advisory (RUSTSEC-2026-0002) no longer matches any crate in the dependency tree, causing cargo-deny to fail with "advisory was not encountered". The vulnerable lru versions (0.9.0–0.16.2) have been patched — lru 0.16.3 is already in Cargo.lock. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: Update lz4_flex to 0.12.1 lz4_flex 0.12.0 suffers from RUSTSEC-2026-0041 https://rustsec.org/advisories/RUSTSEC-2026-0041 --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: wwared <541936+wwared@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RUSTSEC-2026-0002ignore entry fromrust/deny.toml— the advisory no longer matches any crate in the dependency tree, causingcargo-denyto fail with"advisory was not encountered".lruversions (0.9.0–0.16.2) have been patched;lru0.16.3 is already inCargo.lock.rust-denyCI for all open PRs (e.g. fix: correct cd paths in kona action test recipes #19597).Test plan
rust-denyCI job passes on this PR🤖 Generated with Claude Code