fix: update lz4_flex 0.11.5 → 0.11.6 (RUSTSEC-2026-0041)
All checks were successful
CI / Check (pull_request) Successful in 10m54s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped

Fixes high-severity advisory: decompressing invalid data can leak
uninitialized memory. Transitive dep via tantivy → compliance-graph.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
2026-03-17 21:21:05 +01:00
parent 0236cad536
commit 681201ff45

4
Cargo.lock generated
View File

@@ -3245,9 +3245,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
[[package]]
name = "lz4_flex"
version = "0.11.5"
version = "0.11.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "08ab2867e3eeeca90e844d1940eab391c9dc5228783db2ed999acbc0a9ed375a"
checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
[[package]]
name = "lzma-rs"