From c3c8dfd4daaf8ed54f98dcb1c41490426c81cade Mon Sep 17 00:00:00 2001 From: Shekhar Mudarapu Date: Fri, 31 Jul 2026 16:32:16 -0400 Subject: [PATCH] fix(deps): bump event-listener to 5.4.2 (RUSTSEC-2026-0221) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `event-listener` 5.4.1 allows `!Send` tags to cross thread boundaries via `StackSlot` (RUSTSEC-2026-0221, published 2026-07-13). It reaches the runtime-manager transitively through async-broadcast, so this is a lockfile-only change: no manifest edit, no API surface touched. Turned up when the vuln gate went red on an unrelated PR — the advisory database picked it up between this morning's runs and this afternoon's, so it now fails on master too. This clears RUSTSEC-2026-0221 only. `cargo audit` still reports RUSTSEC-2026-0222 (wasmtime 45.0.3, "Stores can mix up type indices between engines"), which is NOT fixable the same way: every patched line the advisory allows — 46.0.2+ and 47.0.3+ — pulls cranelift crates requiring Rust 1.94, while the repo pins 1.93 in rust-toolchain.toml, two CI workflows, and the service Dockerfiles. That is a cross-cutting toolchain decision and gets its own change rather than riding along here. Verified: cargo audit no longer reports 0221, release build clean. --- services/runtime-manager/Cargo.lock | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/services/runtime-manager/Cargo.lock b/services/runtime-manager/Cargo.lock index 75e36355..ad6ee5fa 100644 --- a/services/runtime-manager/Cargo.lock +++ b/services/runtime-manager/Cargo.lock @@ -463,15 +463,6 @@ dependencies = [ "thiserror 2.0.18", ] -[[package]] -name = "concurrent-queue" -version = "2.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" -dependencies = [ - "crossbeam-utils", -] - [[package]] name = "core-foundation" version = "0.9.4" @@ -930,11 +921,10 @@ dependencies = [ [[package]] name = "event-listener" -version = "5.4.1" +version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" dependencies = [ - "concurrent-queue", "parking", "pin-project-lite", ]