From 9f02e7e370d8b9090155929aa0a02f28fa99c8cf Mon Sep 17 00:00:00 2001 From: OceanLi <122793010+ohdearquant@users.noreply.github.com> Date: Sun, 12 Jul 2026 12:34:31 -0400 Subject: [PATCH 1/3] fix(deps): bump crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204) Invalid-pointer-dereference advisory in crossbeam-epoch's fmt::Pointer impl for Atomic/Shared when the underlying pointer is invalid. Fixed upstream in 0.9.20; lockfile-only bump, no API changes reach our code (crossbeam-epoch is a transitive dep of crossbeam 0.8.4, itself pulled by ruvector-core and most of the workspace). Verified: cargo build -p ruvector-core && cargo test -p ruvector-core --lib (228 passed, 0 failed). cargo audit and cargo deny check advisories both clear this advisory after the bump. Co-Authored-By: Leo --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 361ce58a1..78fce2a48 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1846,9 +1846,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] From fc667dda1e5ab9d1e7d9b0c126aae8c58a6c382c Mon Sep 17 00:00:00 2001 From: OceanLi <122793010+ohdearquant@users.noreply.github.com> Date: Sun, 12 Jul 2026 12:34:39 -0400 Subject: [PATCH 2/3] chore(deps): document unfixable quick-xml DoS advisories (RUSTSEC-2026-0195, RUSTSEC-2026-0194) quick-xml 0.26.0 carries two DoS advisories (unbounded namespace-decl allocation, quadratic duplicate-attribute check; both severity 7.5). No lockfile-only or minimal-range fix is currently possible: quick-xml is pulled only via inferno (flamegraph rendering) <- pprof (the optional 'profiling' feature of ruvector-bench, never a production dependency), and pprof's newest release (0.15.0) still requires inferno = "^0.11", whose newest patch (0.11.21, already latest-locked) still requires quick-xml = "^0.26". Verified directly via 'cargo update -p inferno'/'cargo update -p quick-xml' dry runs against a temporarily-bumped pprof requirement, not from changelog inspection. quick-xml in this path only parses profiler-internal XML produced locally by the flamegraph tooling, never network-facing or attacker-supplied input, so the DoS surface is not reachable in our usage even pre-fix. Documented in .cargo/audit.toml with a re-review trigger (pprof depending on inferno >=0.12), matching this file's existing pattern for other upstream-blocked advisories (e.g. RUSTSEC-2026-0002 for the same pprof/profiling feature). Co-Authored-By: Leo --- .cargo/audit.toml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 202c3718b..e79cf72eb 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -19,6 +19,25 @@ ignore = [ # Re-evaluate when the `rsa` crate ships a constant-time implementation. "RUSTSEC-2023-0071", + # quick-xml 0.26.0 — memory-exhaustion DoS via unbounded namespace- + # declaration allocation (RUSTSEC-2026-0195) and quadratic run time on + # duplicate-attribute checks (RUSTSEC-2026-0194), both severity 7.5. + # Pulled transitively only via `inferno` (flamegraph rendering) <- + # `pprof` (optional `profiling` feature of ruvector-bench, never a + # production dependency). No lockfile-only bump is possible: `pprof` + # 0.15.0 (the newest release on crates.io as of this review) still + # requires `inferno = "^0.11"`, and `inferno` 0.11.21 (the newest + # patch in that line) still requires `quick-xml = "^0.26"` — verified + # directly via `cargo update -p inferno`/`cargo update -p quick-xml` + # dry runs, not from changelog inspection alone. quick-xml here only + # parses profiler-internal XML on the local machine (never + # network-facing or attacker-supplied input), so the DoS surface is + # not reachable in our usage even before a fix ships. Re-review when + # `pprof` cuts a release depending on `inferno` >=0.12, or track + # https://github.com/jonhoo/inferno for a quick-xml bump. + "RUSTSEC-2026-0195", + "RUSTSEC-2026-0194", + # ------------------------------------------------------------------ # "Unmaintained" warnings (informational, not vulnerabilities) # ------------------------------------------------------------------ From f3ee3cbc18d607d3344d218b38a1865bf79806d3 Mon Sep 17 00:00:00 2001 From: OceanLi <122793010+ohdearquant@users.noreply.github.com> Date: Sun, 12 Jul 2026 12:34:47 -0400 Subject: [PATCH 3/3] chore(deps): document unfixable ttf-parser unmaintained advisory (RUSTSEC-2026-0192) ttf-parser is unmaintained per the upstream author (no further fixes planned); the RustSec advisory itself states 'No safe upgrade is available!'. Reaches the workspace's dependency graph at three independent versions, none reachable by a version bump: 0.15.2 via rusttype 0.9.3 -> owned_ttf_parser (dev-only, scipix example) 0.20.0 via plotters 0.3.7 -> criterion (dev-dep, workspace-wide) and ruvector-bench's own chart rendering (publish = false) 0.25.1 via imageproc 0.25.1 -> ab_glyph -> owned_ttf_parser (scipix) All three paths are dev-dependencies or unpublished bench-only tooling; none reach a published/production artifact, and font-parsing inputs in all three are local example assets, not attacker-controlled. This was failing 'cargo deny check advisories' (error[unmaintained]), one of the workspace's five supply-chain CI layers. Documented in deny.toml's advisories.ignore with a re-review trigger, matching the file's existing pattern for similarly-situated unmaintained-with-no-fix advisories (e.g. RUSTSEC-2026-0105 for rusttype in the same chain). Verified: cargo deny check advisories -> advisories ok (previously FAILED on this crate). Full cargo deny check -> advisories ok, bans ok, licenses ok, sources ok. cargo build -p ruvector-bench --features profiling succeeds unchanged. Co-Authored-By: Leo --- deny.toml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/deny.toml b/deny.toml index f6fbf3ff7..1890f8872 100644 --- a/deny.toml +++ b/deny.toml @@ -125,6 +125,21 @@ ignore = [ # 2026-08-01. "RUSTSEC-2026-0105", + # ttf-parser — unmaintained, upstream author stated no further fixes + # will be released (RUSTSEC-2026-0192); the advisory itself states + # "No safe upgrade is available!". Reaches the graph at three + # independent versions, none of them fixable by a version bump: + # 0.15.2 via rusttype 0.9.3 -> owned_ttf_parser (dev-only, scipix) + # 0.20.0 via plotters 0.3.7 -> criterion (dev-dep, workspace-wide) and + # -> ruvector-bench's own chart rendering (publish = false) + # 0.25.1 via imageproc 0.25.1 -> ab_glyph -> owned_ttf_parser (scipix) + # All three paths are dev-dependencies or unpublished bench-only tooling, + # never linked into a published/production artifact; font-parsing + # inputs are local example assets, not attacker-controlled. Re-review + # 2026-08-01 or when a maintained fork (e.g. skrifa) is adopted by + # rusttype/plotters/imageproc upstream. + "RUSTSEC-2026-0192", + # memmap2 0.9.x — unsound `Unchecked pointer offset` API (RUSTSEC-2026-0186, # "unsound", not an exploitable vuln). Transitive via safetensors/candle # mmap loading and other crates; no fixed release on the 0.9 line yet.