diff --git a/Cargo.lock b/Cargo.lock
index 46f20b5..b5e8b04 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,17 +2,6 @@
# It is not intended for manual editing.
version = 4
-[[package]]
-name = "ahash"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
-dependencies = [
- "getrandom 0.2.15",
- "once_cell",
- "version_check",
-]
-
[[package]]
name = "aho-corasick"
version = "1.1.3"
@@ -73,9 +62,9 @@ dependencies = [
[[package]]
name = "anyhow"
-version = "1.0.83"
+version = "1.0.104"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25bdb32cbbdce2b519a9cd7df3a678443100e265d5e25ca763b7572a5104f5f3"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
[[package]]
name = "arrayvec"
@@ -314,9 +303,9 @@ dependencies = [
[[package]]
name = "error-stack"
-version = "0.5.0"
+version = "0.8.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe413319145d1063f080f27556fd30b1d70b01e2ba10c2a6e40d4be982ffc5d1"
+checksum = "d01a8d4d427153bae0c38ca68d7912cbf9903fdcc97ecac18801738b3656a46d"
dependencies = [
"anyhow",
"rustc_version",
@@ -361,17 +350,6 @@ dependencies = [
"unicode-width",
]
-[[package]]
-name = "getrandom"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
-]
-
[[package]]
name = "getrandom"
version = "0.3.3"
@@ -381,7 +359,7 @@ dependencies = [
"cfg-if",
"libc",
"r-efi",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasi",
]
[[package]]
@@ -408,9 +386,6 @@ name = "hashbrown"
version = "0.12.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-dependencies = [
- "ahash",
-]
[[package]]
name = "hashbrown"
@@ -511,15 +486,6 @@ version = "0.4.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
-[[package]]
-name = "lru"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999beba7b6e8345721bd280141ed958096a2e4abdf74f67ff4ce49b4b54e47a"
-dependencies = [
- "hashbrown 0.12.3",
-]
-
[[package]]
name = "matchers"
version = "0.2.0"
@@ -542,7 +508,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8d1d5792299bab3f8b5d88d1b7a7cb50ad7ef039a8c4d45a6b84880a6526276"
dependencies = [
"lazy_static",
- "lru",
"memoize-inner",
]
@@ -721,9 +686,9 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
[[package]]
name = "rustc_version"
-version = "0.4.0"
+version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
dependencies = [
"semver",
]
@@ -875,7 +840,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "15b61f8f20e3a6f7e0649d825294eaf317edce30f82cf6026e7e4cb9222a7d1e"
dependencies = [
"fastrand",
- "getrandom 0.3.3",
+ "getrandom",
"once_cell",
"rustix",
"windows-sys 0.59.0",
@@ -997,12 +962,6 @@ version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
[[package]]
name = "wait-timeout"
version = "0.2.0"
@@ -1022,12 +981,6 @@ dependencies = [
"winapi-util",
]
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
[[package]]
name = "wasi"
version = "0.14.2+wasi-0.2.4"
diff --git a/Cargo.toml b/Cargo.toml
index 0a83a15..c18fc5f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,14 +13,19 @@ path = "src/lib.rs"
clap = { version = "4.5.45", features = ["derive"] }
clap_derive = "4.5.45"
crossbeam-channel = "0.5.15"
-error-stack = "0.5.0"
+error-stack = "0.8.0"
enum_dispatch = "0.3.13"
fast-glob = "1.0.0"
glob = "0.3.3"
ignore = "0.4.23"
itertools = "0.14.0"
lazy_static = "1.5.0"
-memoize = "0.5.1"
+# `default-features = false` drops memoize's optional `lru` dependency, which is
+# pinned to lru ^0.7 and carries RUSTSEC-2026-0253 (use-after-free in
+# `LruCache::pop()`; only fixed in lru >= 0.18.2, which memoize cannot resolve).
+# We only use bare `#[memoize]`, so the `Capacity`/`TimeToLive` options that need
+# `lru` are unused.
+memoize = { version = "0.5.1", default-features = false }
path-clean = "1.0.1"
rayon = "1.10.0"
regex = "1.11.1"
diff --git a/src/cache/file.rs b/src/cache/file.rs
index 4132ab8..7900139 100644
--- a/src/cache/file.rs
+++ b/src/cache/file.rs
@@ -1,5 +1,5 @@
use crate::project::Error;
-use error_stack::{Result, ResultExt};
+use error_stack::{Report, ResultExt};
use std::{
collections::HashMap,
fs::{self, File, OpenOptions},
@@ -20,7 +20,7 @@ pub struct GlobalCache {
const DEFAULT_CACHE_CAPACITY: usize = 50000;
impl Caching for GlobalCache {
- fn get_file_owner(&self, path: &Path) -> Result