fix(deps): resolve RUSTSEC advisories in lru, anyhow and error-stack

Cargo.toml

@@ -13,14 +13,19 @@ path = "src/lib.rs"
 clap = { version = "4.5.45", features = ["derive"] }
 clap_derive = "4.5.45"
 crossbeam-channel = "0.5.15"
-error-stack = "0.5.0"
+error-stack = "0.8.0"
 enum_dispatch = "0.3.13"
 fast-glob = "1.0.0"
 glob = "0.3.3"
 ignore = "0.4.23"
 itertools = "0.14.0"
 lazy_static = "1.5.0"
-memoize = "0.5.1"
+# `default-features = false` drops memoize's optional `lru` dependency, which is
+# pinned to lru ^0.7 and carries RUSTSEC-2026-0253 (use-after-free in
+# `LruCache::pop()`; only fixed in lru >= 0.18.2, which memoize cannot resolve).
+# We only use bare `#[memoize]`, so the `Capacity`/`TimeToLive` options that need
+# `lru` are unused.
+memoize = { version = "0.5.1", default-features = false }
 path-clean = "1.0.1"
 rayon = "1.10.0"
 regex = "1.11.1"

src/cache/file.rs

@@ -1,5 +1,5 @@
 use crate::project::Error;
-use error_stack::{Result, ResultExt};
+use error_stack::{Report, ResultExt};
 use std::{
     collections::HashMap,
     fs::{self, File, OpenOptions},
@@ -20,7 +20,7 @@ pub struct GlobalCache {
 const DEFAULT_CACHE_CAPACITY: usize = 50000;
 
 impl Caching for GlobalCache {
-    fn get_file_owner(&self, path: &Path) -> Result<Option<FileOwnerCacheEntry>, Error> {
+    fn get_file_owner(&self, path: &Path) -> Result<Option<FileOwnerCacheEntry>, Report<Error>> {
         if let Some(cache_mutex) = self.file_owner_cache.as_ref()
             && let Ok(cache) = cache_mutex.lock()
             && let Some(cached_entry) = cache.get(path)
@@ -42,7 +42,7 @@ impl Caching for GlobalCache {
         }
     }
 
-    fn persist_cache(&self) -> Result<(), Error> {
+    fn persist_cache(&self) -> Result<(), Report<Error>> {
         let cache_path = self.get_cache_path();
         let file = OpenOptions::new()
             .write(true)
@@ -60,15 +60,15 @@ impl Caching for GlobalCache {
         }
     }
 
-    fn delete_cache(&self) -> Result<(), Error> {
+    fn delete_cache(&self) -> Result<(), Report<Error>> {
         let cache_path = self.get_cache_path();
         tracing::debug!("Deleting cache file: {}", cache_path.display());
         fs::remove_file(cache_path).change_context(Error::Io)
     }
 }
 
 impl GlobalCache {
-    pub fn new(base_path: PathBuf, cache_directory: String) -> Result<Self, Error> {
+    pub fn new(base_path: PathBuf, cache_directory: String) -> Result<Self, Report<Error>> {
         let mut cache = Self {
             base_path,
             cache_directory,
@@ -78,7 +78,7 @@ impl GlobalCache {
         Ok(cache)
     }
 
-    fn load_cache(&mut self) -> Result<(), Error> {
+    fn load_cache(&mut self) -> Result<(), Report<Error>> {
         let cache_path = self.get_cache_path();
         if !cache_path.exists() {
             self.file_owner_cache = Some(Box::new(Mutex::new(HashMap::with_capacity(DEFAULT_CACHE_CAPACITY))));
@@ -102,7 +102,7 @@ impl GlobalCache {
         cache_dir.join("project-file-cache.json")
     }
 }
-fn get_file_timestamp(path: &Path) -> Result<u64, Error> {
+fn get_file_timestamp(path: &Path) -> Result<u64, Report<Error>> {
     let metadata = fs::metadata(path).change_context(Error::Io)?;
     metadata
         .modified()
@@ -119,7 +119,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn test_cache_dir() -> Result<(), Error> {
+    fn test_cache_dir() -> Result<(), Report<Error>> {
         let temp_dir = tempdir().change_context(Error::Io)?;
         let cache_dir = "test-codeowners-cache";
         let cache = GlobalCache::new(temp_dir.path().to_path_buf(), cache_dir.to_owned())?;
@@ -162,7 +162,7 @@ mod tests {
     }
 
     #[test]
-    fn test_corrupted_cache() -> Result<(), Error> {
+    fn test_corrupted_cache() -> Result<(), Report<Error>> {
         let temp_dir = tempdir().change_context(Error::Io)?;
         let cache_dir = "test-codeowners-cache";
         let cache = GlobalCache::new(temp_dir.path().to_path_buf(), cache_dir.to_owned())?;

src/cache/mod.rs

@@ -1,6 +1,6 @@
 use crate::project::Error;
 use enum_dispatch::enum_dispatch;
-use error_stack::Result;
+use error_stack::Report;
 use file::GlobalCache;
 use noop::NoopCache;
 use std::path::Path;
@@ -16,10 +16,10 @@ pub enum Cache {
 
 #[enum_dispatch(Cache)]
 pub trait Caching {
-    fn get_file_owner(&self, path: &Path) -> Result<Option<FileOwnerCacheEntry>, Error>;
+    fn get_file_owner(&self, path: &Path) -> Result<Option<FileOwnerCacheEntry>, Report<Error>>;
     fn write_file_owner(&self, path: &Path, owner: Option<String>);
-    fn persist_cache(&self) -> Result<(), Error>;
-    fn delete_cache(&self) -> Result<(), Error>;
+    fn persist_cache(&self) -> Result<(), Report<Error>>;
+    fn delete_cache(&self) -> Result<(), Report<Error>>;
 }
 
 #[derive(Clone, Debug, serde::Serialize, serde::Deserialize, PartialEq)]

src/cache/noop.rs

@@ -1,5 +1,5 @@
 use crate::project::Error;
-use error_stack::Result;
+use error_stack::Report;
 use std::path::Path;
 
 use super::{Caching, FileOwnerCacheEntry};
@@ -8,19 +8,19 @@ use super::{Caching, FileOwnerCacheEntry};
 pub struct NoopCache {}
 
 impl Caching for NoopCache {
-    fn get_file_owner(&self, _path: &Path) -> Result<Option<FileOwnerCacheEntry>, Error> {
+    fn get_file_owner(&self, _path: &Path) -> Result<Option<FileOwnerCacheEntry>, Report<Error>> {
         Ok(None)
     }
 
     fn write_file_owner(&self, _path: &Path, _owner: Option<String>) {
         // noop
     }
 
-    fn persist_cache(&self) -> Result<(), Error> {
+    fn persist_cache(&self) -> Result<(), Report<Error>> {
         Ok(())
     }
 
-    fn delete_cache(&self) -> Result<(), Error> {
+    fn delete_cache(&self) -> Result<(), Report<Error>> {
         Ok(())
     }
 }

src/cli.rs

@@ -1,7 +1,7 @@
 use clap::{Parser, Subcommand};
 use codeowners::runner::RunConfig;
 use codeowners::runner::{self, Error as RunnerError, RunResult};
-use error_stack::{Result, ResultExt};
+use error_stack::{Report, ResultExt};
 use path_clean::PathClean;
 use std::path::{Path, PathBuf};
 
@@ -82,30 +82,30 @@ struct Args {
 }
 
 impl Args {
-    fn absolute_project_root(&self) -> Result<PathBuf, RunnerError> {
+    fn absolute_project_root(&self) -> Result<PathBuf, Report<RunnerError>> {
         self.project_root.canonicalize().change_context(RunnerError::Io(format!(
             "Can't canonicalize project root: {}",
             &self.project_root.to_string_lossy()
         )))
     }
 
-    fn absolute_config_path(&self) -> Result<PathBuf, RunnerError> {
+    fn absolute_config_path(&self) -> Result<PathBuf, Report<RunnerError>> {
         Ok(self.absolute_path(&self.config_path)?.clean())
     }
 
-    fn absolute_codeowners_path(&self) -> Result<Option<PathBuf>, RunnerError> {
+    fn absolute_codeowners_path(&self) -> Result<Option<PathBuf>, Report<RunnerError>> {
         match &self.codeowners_file_path {
             Some(path) => Ok(Some(self.absolute_path(path)?.clean())),
             None => Ok(None),
         }
     }
 
-    fn absolute_path(&self, path: &Path) -> Result<PathBuf, RunnerError> {
+    fn absolute_path(&self, path: &Path) -> Result<PathBuf, Report<RunnerError>> {
         Ok(self.absolute_project_root()?.join(path))
     }
 }
 
-pub fn cli() -> Result<RunResult, RunnerError> {
+pub fn cli() -> Result<RunResult, Report<RunnerError>> {
     let args = Args::parse();
 
     let config_path = args.absolute_config_path()?;

src/main.rs

@@ -2,18 +2,18 @@ mod cli;
 use std::process;
 
 use codeowners::runner::{Error as RunnerError, RunResult};
-use error_stack::Result;
+use error_stack::Report;
 
 use crate::cli::cli;
 
-fn main() -> Result<(), RunnerError> {
+fn main() -> Result<(), Report<RunnerError>> {
     install_logger();
     maybe_print_errors(cli()?)?;
 
     Ok(())
 }
 
-fn maybe_print_errors(result: RunResult) -> Result<(), RunnerError> {
+fn maybe_print_errors(result: RunResult) -> Result<(), Report<RunnerError>> {
     if !result.info_messages.is_empty() {
         for msg in result.info_messages {
             println!("{}", msg);

src/ownership/validator.rs

@@ -5,7 +5,6 @@ use std::fmt::Display;
 use std::path::PathBuf;
 use std::sync::Arc;
 
-use error_stack::Context;
 use itertools::Itertools;
 use rayon::prelude::IntoParallelRefIterator;
 use rayon::prelude::ParallelIterator;
@@ -258,7 +257,7 @@ impl Display for Errors {
     }
 }
 
-impl Context for Errors {}
+impl core::error::Error for Errors {}
 
 #[cfg(test)]
 mod tests {