build(deps): bump lru from 0.16.1 to 0.16.3 in /test/simulator-graphical (#1741)
What the developer wrote
Authored by dependabot[bot]
build(deps): bump lru from 0.16.1 to 0.16.3 in /test/simulator-graphical (#1741)
Bumps [lru](https://github.com/jeromefroe/lru-rs) from 0.16.1 to 0.16.3.
- [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jeromefroe/lru-rs/compare/0.16.1...0.16.3)
---
updated-dependencies:
- dependency-name: lru
dependency-version: 0.16.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
What changed, and why it matters
This is an automated dependency update by Dependabot that bumps the Rust 'lru' crate from version 0.16.1 to 0.16.3 inside a graphical simulator test component. The change only modifies a test-only lockfile and does not touch the actual BitBox02 firmware code. There is no indication in the commit that this fixes a security issue, and the supplied references do not mention any security relevance.
Treat as routine maintenance. If security relevance is suspected, review the upstream lru-rs 0.16.1 to 0.16.3 changelog for any disclosed fixes, but the commit itself provides no evidence of a security issue.
Security signals we found
Dependency bump in test-only code
Transitive dependency 'zeroize' added (memory-clearing utility, not a vulnerability signal)
No security-relevant description in commit message or title
Evidence from the diff
The commit updates an indirect dependency, lru 0.16.1 -> 0.16.3, in test/simulator-graphical/Cargo.lock. The diff also shows that the updated lru version pulls in an additional transitive dependency, zeroize. The change is confined to a test/simulator graphical harness and does not affect the embedded firmware build or runtime code. No CVE, advisory, or vendor security statement is present in the commit or supplied references.
Changed components
test/simulator-graphical/Cargo.lockInspect captured patch +3 / −2
diff --git a/test/simulator-graphical/Cargo.lock b/test/simulator-graphical/Cargo.lock
index 492cf0a..18646da 100644
--- a/test/simulator-graphical/Cargo.lock
+++ b/test/simulator-graphical/Cargo.lock
@@ -1573,9 +1573,9 @@ dependencies = [
[[package]]
name = "lru"
-version = "0.16.1"
+version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe949189f46fabb938b3a9a0be30fdd93fd8a09260da863399a8cf3db756ec8"
+checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "matchers"
@@ -3110,6 +3110,7 @@ dependencies = [
"hex",
"num-bigint",
"sha2",
+ "zeroize",
]
[[package]]
Why this scored 10/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.