rust/backlog
10
0
Issues 35 Projects Activity

update packages to lru v0.18.2 to address RUSTSEC-2026-0253 #39

New issue
Open
opened 2026-08-27 09:55:15 +00:00 by decathorpe · 3 comments
decathorpe commented 2026-08-27 09:55:15 +00:00
Owner
Copy link

There's a recently published RUSTSEC advisory for the lru crate:
https://rustsec.org/advisories/RUSTSEC-2026-0253.html

This issue has only been fixed in v0.18.2, but the Fedora package(s) are currently all stuck on older versions.

Affected packages (lru v0.16):

  • aw-server-rust
  • fish
  • papers
  • python-pydantic-core
  • rust-num-prime
  • rust-ratatui-core

Affected packages (lru v0.13):

  • fish (f43, epel10)

Affected packages (lru v0.12):

  • nushell
  • rust-nu-protocol (f44)
  • rust-num-prime (f43)
  • rust-ratatui0.26
  • rust-ratatui0.29
  • rust-rqrr
There's a recently published RUSTSEC advisory for the lru crate: <https://rustsec.org/advisories/RUSTSEC-2026-0253.html> This issue has only been fixed in v0.18.2, but the Fedora package(s) are currently all stuck on older versions. Affected packages (lru v0.16): - [ ] aw-server-rust - [ ] fish - [ ] papers - [ ] python-pydantic-core - [ ] rust-num-prime - [ ] rust-ratatui-core Affected packages (lru v0.13): - [ ] fish (f43, epel10) Affected packages (lru v0.12): - [ ] nushell - [ ] rust-nu-protocol (f44) - [ ] rust-num-prime (f43) - [ ] rust-ratatui0.26 - [ ] rust-ratatui0.29 - [ ] rust-rqrr
music commented 2026-08-27 11:22:54 +00:00
Member
Copy link

Pydantic tends to be fussy (lots of code exercising lots of API surface in its dependencies, very high test coverage that can catch subtle behavior changes), but upstream updated lru in an unreleased commit without source-code changes, so patching the bound is worth a try. I’ll wait until lru 0.18 is available in the repos.

Pydantic tends to be fussy (lots of code exercising lots of API surface in its dependencies, very high test coverage that can catch subtle behavior changes), but upstream [updated `lru`](https://github.com/pydantic/pydantic/commit/97929719f013de7fcebf887e253d3021b8a1c3ea) in an unreleased commit without source-code changes, so patching the bound is worth a try. I’ll wait until lru 0.18 is available in the repos.
ngompa commented 2026-08-28 20:02:36 +00:00
Owner
Copy link

Fish can be upgraded, it's just we're waiting on this update to be done to deal with it.

Fish can be upgraded, it's just we're waiting on this update to be done to deal with it.
decathorpe commented 2026-09-06 17:42:40 +00:00
Author
Owner
Copy link

Updates submitted:

Updates submitted: - rawhide: <https://bodhi.fedoraproject.org/updates/FEDORA-2026-a4ab790e17> - f45: <https://bodhi.fedoraproject.org/updates/FEDORA-2026-cf36f81efc> - f44: <https://bodhi.fedoraproject.org/updates/FEDORA-2026-33c180c1b0> - f43: <https://bodhi.fedoraproject.org/updates/FEDORA-2026-332a62112c> - epel10: <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-5ebad042c9> - epel9: <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-addfdae9ee>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
No results found.
No results found.
Labels
Clear labels   
compat-cleanup
Issues related to reducing the number of parallel-installable crate versions ("compat packages")

  
coordination
Issues related to crate updates that need to be coordinated across many dependent packages

  
rebuild
Issues related to package rebuilds to apply fixes for bugs and security issues

  
unmaintained
Issues related to migrating away from unmaintained crates

  
update-backlog
Issues related to important pending application and library updates

No labels
compat-cleanup
coordination
rebuild
unmaintained
update-backlog
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rust/backlog#39
No description provided.