Repository navigation
fix(deps): RUSTSEC-2026-0204 crossbeam-epoch bump — unbreaks cargo-deny on every PR - #5746
Merged
Merged
Conversation
…drop stale RUSTSEC-2026-0097 ignore RUSTSEC-2026-0204 (invalid pointer deref in crossbeam-epoch's fmt::Pointer impl) fails the advisories gate on every PR. Transitive dep → lockfile bump per the remediation playbook. The 0097 ignore no longer matches any crate (advisory-not-detected warning) — its rand pattern left the tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
Contributor
✅ IronLoop Review StatusHead: Current reviewers:
Reviewer summaries
Recent activity
Available commands
Run metadataAdmission: webhook accepted the request and IronLoop persisted review state before this projection. |
railway-app
Bot
temporarily deployed
to
ironclaw-ci-preview / ironclaw-pr-5746
July 7, 2026 00:19
Destroyed
github-actions
Bot
added
scope: dependencies
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughRemoved the RUSTSEC-2026-0097 entry from the advisories.ignore list in deny.toml, so cargo-deny no longer suppresses that advisory. Changescargo-deny advisory ignore list update
Estimated code review effort: 1 (Trivial) | ~2 minutes Related PRs: None identified. Suggested labels: dependencies, security Suggested reviewers: None identified. Advisory expired, ignore list trims tight, 🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![ironloopai[bot]](https://avatars.githubusercontent.com/in/4116490?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ IronLoop Review: reviewer
Verdict: ✅ Approved
Findings: 0 blocking / 0 notes
Next: No reviewer action needed.
Head: 79c5a27f7f8688d2863f0c481c232a7d84163ab7
Run details
Status: Current
Needs human: no
Needs validation: no
Summary
No blocking issues found. The PR is limited to a lockfile bump of crossbeam-epoch from 0.9.18 to 0.9.20 and removal of the stale RUSTSEC-2026-0097 advisory ignore; the changed dependency entry is internally consistent and no changed source behavior was introduced.
Findings
None.
Developer follow-up
After fixing this feedback:
- Push the fix to this PR branch.
- Re-run this reviewer with
@ironloop review --agent reviewerif you only changed this reviewer's findings. - Re-run all reviewers with
@ironloop reviewwhen the fix may affect multiple areas. - Use
@ironloop statusto check queued/running/completed/stale/stalled state while reviewers run.
Contributor
Coverage ratchetReborn integration-tier coverageLine coverage (Reborn crates): 85.32% — 273242 / 320255 lines Per-crate breakdown (65 crates, lowest-covered first)
This table itself is informational and never gates the PR on its own — not the percentage, not the per-crate holes, not the 0-coverage callout. A separate coverage ratchet (dry-run until enforce=true; see tests/integration/coverage-floor.toml) can fail the build on specific configured floors. Exemptions (4 entry/entries excluded from the accounting above)
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Every open PR's
cargo-denycheck is red. Root cause (reproduced locally, not PR-specific): RUSTSEC-2026-0204 — invalid pointer dereference incrossbeam-epoch0.9.18'sfmt::Pointerimpl. Transitive dep (viatermimad/crossbeam-dequetrees), so per the remediation playbook this is a lockfile bump, not a manifest change:cargo update -p crossbeam-epoch→ 0.9.20 (patch, advisory's stated fix version).Also drops the stale
RUSTSEC-2026-0097ignore — cargo-deny warnsadvisory-not-detected(the rand pattern left the dependency tree), and the ignore's own comment said revisit by 2026-06-30.Verification
cargo deny checklocal:advisories ok, bans ok, licenses ok, sources ok(wasadvisories FAILED).Merge-first candidate: unblocks the cargo-deny check on all open PRs once they merge/rebase past it.
🤖 Generated with Claude Code