From 152088105b5e8fa2142a385c37fe0f701fca0e34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C5=ABdolfs=20O=C5=A1i=C5=86=C5=A1?= <rudolfs@osins.org>
Date: Fri, 28 Aug 2026 13:26:23 +0200
Subject: [PATCH] Fix cargo audit reported warnings

---
 .cargo/audit.toml               |  6 ++++++
 Cargo.lock                      | 28 +++++++++++-----------------
 crates/radicle-httpd/Cargo.toml |  2 +-
 3 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 6e335ceed..fcddadc0a 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -1,4 +1,10 @@
 [advisories]
 ignore = [
   "RUSTSEC-2023-0071", # https://radicle.network/nodes/iris.radicle.network/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/issues/bd8af7a5e3fd02c0963d7550a5cc2cab00950775
+  # atomic-polyfill is unmaintained. It reaches the lockfile through
+  # radicle-artifact -> postcard -> heapless 0.7, which only depends on it for
+  # AVR, RISC-V, thumbv6m and Xtensa bare-metal targets, so it is never
+  # compiled for any target we build. postcard 1.x pins heapless ^0.7, so this
+  # can only be resolved upstream.
+  "RUSTSEC-2023-0089",
 ]
diff --git a/Cargo.lock b/Cargo.lock
index 15492d832..455e64cb0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -533,9 +533,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -1433,9 +1433,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1461,21 +1461,15 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.1"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
 [[package]]
 name = "heapless"
 version = "0.7.17"
@@ -1763,7 +1757,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown",
  "serde",
  "serde_core",
 ]
@@ -1990,11 +1984,11 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lru"
-version = "0.16.4"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
+checksum = "0d317b4b9eb398e6acce275758ec6125535505e7a146fb1a9b8bda2451b0ff4c"
 dependencies = [
- "hashbrown 0.16.1",
+ "hashbrown",
 ]
 
 [[package]]
@@ -2924,7 +2918,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
diff --git a/crates/radicle-httpd/Cargo.toml b/crates/radicle-httpd/Cargo.toml
index 9e2805080..0b2e1ddb1 100644
--- a/crates/radicle-httpd/Cargo.toml
+++ b/crates/radicle-httpd/Cargo.toml
@@ -32,7 +32,7 @@ futures-util = { version = "0.3.32", default-features = false }
 hyper = { version = "1.6.0", default-features = false }
 infer = { version = "0.19.0" }
 lexopt.workspace = true
-lru = { version = "0.16.0" }
+lru = { version = "0.18.2" }
 mime_guess = { version = "2.0.5" }
 nonempty = { version = "0.12.0", features = ["serialize"] }
 radicle.workspace = true