Skip to content

*: fix clippy by ignoring RUSTSEC-2026-0002 (#19271)#19281

Merged
ti-chi-bot[bot] merged 1 commit intotikv:release-8.5from
you06:release-8.5-RUSTSEC-2026-0002
Jan 13, 2026
Merged

*: fix clippy by ignoring RUSTSEC-2026-0002 (#19271)#19281
ti-chi-bot[bot] merged 1 commit intotikv:release-8.5from
you06:release-8.5-RUSTSEC-2026-0002

Conversation

@you06
Copy link
Contributor

@you06 you06 commented Jan 13, 2026

What is changed and how it works?

Issue Number: ref #19249

What's Changed:

Fix the CI by ignoring `RUSTSEC-2026-0002`.

Related changes

  • PR to update pingcap/docs/pingcap/docs-cn:
  • Need to cherry-pick to the release branch

Check List

Tests

  • Unit test
  • Integration test
  • Manual test (add detailed scripts or steps below)
  • No code

make clippy before this PR:

error[unsound]: `IterMut` violates Stacked Borrows by invalidating internal pointer
    ┌─ /home/you06/workspace/nfs-exports/rust/tikv/Cargo.lock:296:1
    │
296 │ lru 0.12.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0002
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0002
    ├ Affected versions of this crate contain a soundness issue in the `IterMut`
      iterator implementation. The `IterMut::next` and `IterMut::next_back`
      methods temporarily create an exclusive reference to the key when
      dereferencing the internal node pointer.
      
      This invalidates the shared pointer held by the internal `HashMap`,
      violating Stacked Borrows rules.
    ├ Announcement: https://github.com/jeromefroe/lru-rs/pull/224
    ├ Solution: Upgrade to >=0.16.3 (try `cargo update -p lru`)

...

 advisories FAILED: 1 errors, 5 warnings, 14 notes
           bans ok: 0 errors, 0 warnings, 14 notes
       licenses ok: 0 errors, 2 warnings, 631 notes
        sources ok: 0 errors, 0 warnings, 22 notes
make: *** [Makefile:373: clippy] Error 1

make clippy with this PR:

 advisories ok: 0 errors, 5 warnings, 16 notes
       bans ok: 0 errors, 0 warnings, 14 notes
   licenses ok: 0 errors, 2 warnings, 631 notes
    sources ok: 0 errors, 0 warnings, 22 notes
    Finished dev [unoptimized] target(s) in 0.71s

Side effects

  • Performance regression: Consumes more CPU
  • Performance regression: Consumes more Memory
  • Breaking backward compatibility

Release note

None

@you06
workaround clippy by deny RUSTSEC-2026-0002 in release-8.5 branch
54024f9 
Signed-off-by: you06 <you1474600@gmail.com>
@ti-chi-bot ti-chi-bot bot added do-not-merge/cherry-pick-not-approved release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates the PR's author has signed the dco. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jan 13, 2026
@you06 you06 requested review from glorv and overvenus January 13, 2026 05:29
@you06 you06 changed the title *: fix clippy by ignoring RUSTSEC-2026-0002 *: fix clippy by ignoring RUSTSEC-2026-0002 (#19271) Jan 13, 2026
@ti-chi-bot ti-chi-bot bot added needs-1-more-lgtm Indicates a PR needs 1 more LGTM. approved labels Jan 13, 2026
@ti-chi-bot ti-chi-bot bot added lgtm and removed needs-1-more-lgtm Indicates a PR needs 1 more LGTM. labels Jan 13, 2026
@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jan 13, 2026

[LGTM Timeline notifier]

Timeline:

  • 2026-01-13 05:33:47.16428108 +0000 UTC m=+335671.226145985: ☑️ agreed by glorv.
  • 2026-01-13 05:45:31.333417724 +0000 UTC m=+336375.395282628: ☑️ agreed by LykxSassinator.

@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jan 13, 2026

@yudongusa: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jan 13, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: glorv, LykxSassinator, yudongusa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [LykxSassinator,glorv]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ti-chi-bot ti-chi-bot bot added cherry-pick-approved Cherry pick PR approved by release team. and removed do-not-merge/cherry-pick-not-approved labels Jan 13, 2026
@EmmaDuDu
Copy link

EmmaDuDu commented Jan 13, 2026

/retest

@EmmaDuDu
Copy link

EmmaDuDu commented Jan 13, 2026

/test pull-unit-test

@you06
Copy link
Contributor Author

you06 commented Jan 13, 2026

/retest

@EmmaDuDu
Copy link

EmmaDuDu commented Jan 13, 2026

/test pull-unit-test

@EmmaDuDu
Copy link

EmmaDuDu commented Jan 13, 2026

/retest

1 similar comment
@you06
Copy link
Contributor Author

you06 commented Jan 13, 2026

/retest

@ti-chi-bot ti-chi-bot bot merged commit a0234aa into tikv:release-8.5 Jan 13, 2026
5 checks passed
@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jan 13, 2026

@you06: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-unit-test 54024f9 link unknown /test pull-unit-test

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ekexium pushed a commit to ti-chi-bot/tikv that referenced this pull request Jan 19, 2026
@you06 @ekexium
*: fix clippy by ignoring RUSTSEC-2026-0002 (tikv#19271) (tikv#19281)
736b138 
ref tikv#19249

Fix the CI by ignoring `RUSTSEC-2026-0002`.

Signed-off-by: you06 <you1474600@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@glorv glorv glorv approved these changes

@LykxSassinator LykxSassinator LykxSassinator approved these changes

@overvenus overvenus Awaiting requested review from overvenus

+1 more reviewer

@yudongusa yudongusa yudongusa approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

approved cherry-pick-approved Cherry pick PR approved by release team. dco-signoff: yes Indicates the PR's author has signed the dco. lgtm release-note-none Denotes a PR that doesn't merit a release note. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@you06 @EmmaDuDu @glorv @LykxSassinator @yudongusa