Update lru to 0.18.2

[nabbisen]

lru 0.16.4 carries RUSTSEC-2026-0253 — an unsoundness in LruCache::pop(), where the node is freed and the key dropped before it is detached from the intrusive list, so a panic in the key's Drop can leave neighbouring nodes pointing at freed memory. Fixed in lru 0.18.2 by detaching first.

cryoglyph does not appear to be affected, for two independent reasons:

• The cache is LruCache<CacheKey, GlyphDetails, Hasher>, and cosmic_text::CacheKey is Copy — so it cannot implement Drop at all, and the key's drop_in_place is a no-op that cannot panic.
• cryoglyph calls pop_lru(), not the affected pop().

So this is dependency hygiene, not a bug fix.

It matters downstream because every consumer of iced inherits the advisory through iced_wgpu → cryoglyph, and projects running cargo audit --deny warnings in CI go red until they add an exception.

The requirement is "0.18.2" rather than "0.18" deliberately: lru 0.18.0 and 0.18.1 are published and are not patched, so ^0.18 could still resolve to a vulnerable version.

No source changes were needed — the five lru APIs used here (unbounded_with_hasher, get, get_or_insert, peek_lru, pop_lru) are unchanged in 0.18.2. Verified with cargo check against master at f4e7e4e; the resolved lockfile entry is lru 0.18.2.

Happy to close this if you would rather handle it another way.

[nabbisen]

For context: upstream grovesNL/glyphon carries the same requirement (lru = "0.16.2" on main), so this is not specific to the fork. We have opened the equivalent change there as grovesNL/glyphon#182.

The two have diverged (wgpu 29 / etagere 0.2 here vs wgpu 30 / etagere 0.3 upstream), so neither PR substitutes for the other — this one is what reaches iced downstreams.