[n13]

Dependabot alert #14 identifies a real soundness defect in lru 0.12.5: mutable iteration temporarily creates exclusive key references, invalidating the shared key pointers retained by the cache's hash map. Subsequent cache lookups have undefined behavior. This PR backports the two-line fix from upstream #224, preserving the 0.12 API required by smoldot-light.

The shipped Quantus node and runtime are not exposed to this advisory, so this fix is public. Audited public main aae53e3693ab244c86cf3f10bb39e39500f5c6c2 and release v1.0.5 (3ab19542). The lockfile path is frame-benchmarking-cli -> subxt / subxt-rpcs -> optional subxt-lightclient -> smoldot-light -> lru 0.12.5. The node enables benchmarking only through runtime-benchmarks, and Subxt's unstable-light-client feature is not enabled even with all node features enabled. Locked dependency graphs for the release node, all-feature node, and no-default-features Wasm runtime contain neither the affected lru nor the light client. The node's lru 0.7.8 via tracing is outside the advisory's affected range. There is no execution path for this defect to affect funds, keys, consensus, or node availability in those builds. This assessment is specific to this advisory and these configurations.

Vendor lru 0.12.5 with its MIT license, provenance, and upstream tests; select it through [patch.crates-io]. Add a forward/reverse iterator regression that performs cache lookups after mutation, and a pinned Miri CI job for both hash-map implementations. The production node dependency graph is unchanged. The version remains 0.12.5 for compatibility, so version-only scanners may still require a patched-code assessment; no alert has been dismissed.

Validation:

• cargo test --locked -p lru@0.12.5: 44 unit tests, 1 regression, 37 doctests passed.
• Same command with --no-default-features: 43 unit tests, 1 regression, 37 doctests passed.
• Miri on nightly-2026-08-31: regression passes with default features and --no-default-features; the identical regression against pristine crates.io 0.12.5 fails with the reported Stacked Borrows violation.
• cargo clippy --locked -p lru@0.12.5 --all-targets -- -D warnings, workspace Rust/TOML formatting, workflow YAML parsing, and git diff --check passed.
• Locked production dependency graphs checked before and after; all-feature node graph unchanged.

The full node/runtime compilation was not rerun locally; the existing CI matrix remains enabled.

References: RUSTSEC-2026-0002, GHSA-rhfx-m35p-ff5j.

[n13]

Verdict: Approve
Reviewer: GPT-6.1 Sol

Reviewed head f52ed8720a06720027610929c33be6da16b50afe against base aae53e3693ab244c86cf3f10bb39e39500f5c6c2. No blocking findings.

Both IterMut::next and IterMut::next_back match the upstream soundness fix. Comparing the complete vendored source with the checksum-verified crates.io 0.12.5 archive found only those two fixes, workspace formatting, and the documented test-only Clippy allowance. The original license and manifest provenance are preserved.

Validation completed in an isolated detached worktree:

• timeout 60 cargo test --locked -p lru@0.12.5: 44 unit tests, 1 regression, and 37 doctests passed. With --no-default-features: 43 unit tests, 1 regression, and 37 doctests passed.
• Pinned nightly-2026-08-31 Miri regression passed with default features and --no-default-features. Negative controls using pristine 0.12.5 reproduced the Stacked Borrows violation for forward iteration and, separately, reverse iteration.
• cargo clippy --locked -p lru@0.12.5 --all-targets -- -D warnings, pinned workspace rustfmt, Taplo, workflow YAML parsing, and git diff --check passed.
• Locked normal/build dependency graphs for the default node, all-feature node, and no-default-features Wasm runtime exclude lru 0.12.5 and smoldot-light; the node retains the unaffected 0.7.8 dependency. This supports the stated exposure assessment for these configurations.

Keeping version 0.12.5 means version-only advisory scanners may continue reporting it, as documented. Full node/runtime compilation was not repeated locally. GitHub formatting, Miri, dependency cooldown, and Clippy/docs checks passed; both build/test matrix jobs were still running at the final status check.

This is a retrospective approval opinion: the PR closed during review. Submitted as a comment review because the authenticated account authored the PR.

[n13]

Done—dismissed alert #14 as “vulnerable code not used”, with the findings recorded, and closed PR #730.

[n13]

I thought we'd update this package, but actually it's a transient dependency not used in any production code

Closed and marked unused.

Basically dependabot spam.