rust: Address new advisories failing cargo deny#472
Conversation
- Bump anyhow 1.0.101 -> 1.0.103 (fixes RUSTSEC-2026-0190, unsoundness in Error::downcast_mut()). - Bump crossbeam-epoch 0.9.18 -> 0.9.20 (fixes RUSTSEC-2026-0204, invalid pointer dereference in the fmt::Pointer impl for Atomic/Shared). - Ignore RUSTSEC-2026-0173 (proc-macro-error2 unmaintained, no safe upgrade). Build-time dep pulled in transitively via alloy-sol-macro -> alloy-sol-types across the reth/alloy tree. `cargo deny --all-features check all` passes (advisories, bans, licenses, sources all ok).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fe491f4676
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [[package]] | ||
| name = "anyhow" | ||
| version = "1.0.101" | ||
| version = "1.0.103" |
There was a problem hiding this comment.
This only updates the workspace lockfile; the workspace dependency in rust/Cargo.toml still allows anyhow from 1.0.101. For published OP crates, or for consumers that update one of these crates while preserving an existing Cargo.lock, Cargo is still permitted to keep the vulnerable 1.0.101 resolution, so the RUSTSEC-2026-0190 fix is not enforced outside this repository lockfile. Please raise the workspace dependency requirement to the fixed version as well.
Useful? React with 👍 / 👎.
1 participant
cargo deny --all-features check allpasses (advisories, bans, licenses, sources all ok).