From bf36bbdf74a24135e6c61c5cb283acc031ebf087 Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Tue, 15 Sep 2026 15:06:56 +0200
Subject: [PATCH] chore(deps): bump lru to 0.18 and base64 to 0.23

lru < 0.16.3 has an IterMut Stacked Borrows violation (GHSA advisory
flagged by Dependabot on downstream proton-drive-linux).
---
 Cargo.lock | 26 ++++++++++----------------
 Cargo.toml |  4 ++--
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b7d1e80..05b84cb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -979,9 +979,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "foldhash"
-version = "0.1.5"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "form_urlencoded"
@@ -1181,21 +1181,15 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.5"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -1500,7 +1494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown",
 ]
 
 [[package]]
@@ -1662,11 +1656,11 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lru"
-version = "0.12.5"
+version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+checksum = "ff9840bcc50b71349309900da0ce7279aa336ae71d73250b07998932c7d97c25"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown",
 ]
 
 [[package]]
@@ -2075,7 +2069,7 @@ name = "proton-drive-rs"
 version = "0.6.3"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.0",
  "bytes",
  "futures",
  "getrandom 0.4.3",
@@ -2101,7 +2095,7 @@ version = "0.6.3"
 dependencies = [
  "aes-gcm 0.11.0",
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.0",
  "bcrypt",
  "bytes",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index 1e81b46..d2f0d64 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,9 +34,9 @@ serde_repr = "0.1"
 thiserror = "2"
 async-trait = "0.1"
 futures = "0.3"
-lru = "0.12"
+lru = "0.18"
 bytes = "1"
-base64 = "0.22"
+base64 = "0.23"
 hex = "0.4"
 hmac = "0.13"
 sha1 = "0.11"