Security: Update lru Rust dependency to 0.16.3 (GHSA-rhfx-m35p-ff5j) #1294
Description
Summary
The lru Rust crate dependency in temporalio/bridge/Cargo.lock is currently at version 0.16.0, which is affected by a soundness vulnerability.
Vulnerability Details
- Advisory: GHSA-rhfx-m35p-ff5j
- Severity: Low (CVSS 2.7/10)
- Affected versions: 0.9.0 – 0.16.2
- Patched version: 0.16.3
Issue: The IterMut iterator's next and next_back methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer, violating Rust's Stacked Borrows rules.
Requested Action
Please update the lru dependency to version 0.16.3 or later in the Rust bridge's Cargo.lock to resolve this advisory.
Environment
- temporalio version: 1.21.1
- Current lru version in Cargo.lock: 0.16.0