[Security]: RUSTSEC-2026-0253: lru 0.12.5 in Cargo.lock is unsound (use-after-free via LruCache eviction)

[1688mengdie]

Summary

lru 0.12.5 — the version locked in Cargo.lock on main, pulled in
by ratatui 0.29 — is covered by RUSTSEC-2026-0253 (later advisories
reference RUSTSEC-2026-0002): LruCache::pop is not panic-safe, and an
eviction that panics can leave the cache in an inconsistent state,
leading to a use-after-free or double free. The advisory is fixed in
lru >= 0.18.2, which ratatui 0.29 cannot satisfy because it pins
lru ^0.12.

Affected dependency chain

• ratatui 0.29.0 (locked in Cargo.lock, CLI TUI startup path)
• -> lru 0.12.5 (locked; affected range)

Reproduction (from a clean checkout)

1. git clone the repository and check out main.
2. Run cargo audit (or cargo deny check advisories).
3. Observed: lru flagged as unsound at 0.12.5 (RUSTSEC-2026-0253),
   with the advisory requiring lru >= 0.18.2.

Suggested fix

Upgrade ratatui from 0.29 to 0.30 (whose ratatui-core requires
lru ^0.18, resolving the advisory), relax the bitflags pin from
=2.11.1 to ^2 as required by ratatui-core 0.1.2, and carry the
small Backend trait adaptation in the CLI startup loop. I have a patch
ready and will open a PR referencing this issue.