From b37faddd1a56250ce835ee9c79527c13b131c861 Mon Sep 17 00:00:00 2001 From: "Andrei G." Date: Sat, 25 Jul 2026 17:22:26 +0200 Subject: [PATCH 1/3] fix(security): upgrade crossbeam-epoch to 0.9.20 RUSTSEC-2026-0204 flags crossbeam-epoch 0.9.18. The OSV Security Scan in CI fails on this advisory, blocking unrelated PRs such as #303. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 98cf22d..613ddbb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -540,9 +540,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] From 3ade20a8cebb7b8f11b87db7aad1bac26619975f Mon Sep 17 00:00:00 2001 From: "Andrei G." Date: Sat, 25 Jul 2026 17:26:06 +0200 Subject: [PATCH 2/3] fix(security): resolve npm audit findings in pjs-js-client npm audit fix bumps brace-expansion, js-yaml, linkify-it, and shell-quote (via concurrently) to patched versions, resolving 5 high severity DoS advisories flagged by the OSV Security Scan. --- crates/pjs-js-client/package-lock.json | 34 +++++++++++++------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/crates/pjs-js-client/package-lock.json b/crates/pjs-js-client/package-lock.json index 1eaf659..d13925c 100644 --- a/crates/pjs-js-client/package-lock.json +++ b/crates/pjs-js-client/package-lock.json @@ -2979,16 +2979,16 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/browserslist": { @@ -3263,15 +3263,15 @@ "license": "MIT" }, "node_modules/concurrently": { - "version": "9.2.1", - "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.1.tgz", - "integrity": "sha512-fsfrO0MxV64Znoy8/l1vVIjjHa29SZyyqPgQBwhiDcaW8wJc2W3XWVOGx4M3oJBnv/zdUZIIp1gDeS98GzP8Ng==", + "version": "9.2.4", + "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.4.tgz", + "integrity": "sha512-TZ0CEhyzvFjgtAvHTusDMgj7wNdihCh7LLLrzdUOXIhdlnL2JBBGA9eJxR24rtqgmdjh3OA3hrN1rCHj6HM8qA==", "dev": true, "license": "MIT", "dependencies": { "chalk": "4.1.2", "rxjs": "7.8.2", - "shell-quote": "1.8.3", + "shell-quote": "1.9.0", "supports-color": "8.1.1", "tree-kill": "1.2.2", "yargs": "17.7.2" @@ -4960,9 +4960,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -5118,9 +5118,9 @@ "license": "MIT" }, "node_modules/linkify-it": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.1.tgz", - "integrity": "sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==", + "version": "5.0.2", + "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz", + "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==", "dev": true, "funding": [ { @@ -5939,9 +5939,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "dev": true, "license": "MIT", "engines": { From 8f8a02d67e41e539ee1f4f5c48f7890a7a801809 Mon Sep 17 00:00:00 2001 From: "Andrei G." Date: Sat, 25 Jul 2026 17:29:55 +0200 Subject: [PATCH 3/3] fix(pjson-rs): silence fetch_update deprecation on nightly nightly recently deprecated Atomic::fetch_update in favor of try_update, but try_update only stabilizes in 1.95.0, above this crate's 1.89.0 MSRV. RUSTFLAGS=-D warnings otherwise fails every build on a fresh nightly toolchain. --- crates/pjs-core/src/infrastructure/integration/object_pool.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crates/pjs-core/src/infrastructure/integration/object_pool.rs b/crates/pjs-core/src/infrastructure/integration/object_pool.rs index c9af9fe..37f568b 100644 --- a/crates/pjs-core/src/infrastructure/integration/object_pool.rs +++ b/crates/pjs-core/src/infrastructure/integration/object_pool.rs @@ -73,6 +73,8 @@ impl ObjectPool { let pool_size = self.stat_pool_size.load(Ordering::Relaxed); // Best-effort peak tracking: imprecision under concurrency is acceptable. let in_use = created.saturating_sub(pool_size); + // `try_update` (the replacement) is stable since 1.95.0, above this crate's 1.89.0 MSRV. + #[allow(deprecated)] let _ = self .stat_peak .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |prev| {