[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
rustix	dependencies	patch	1.1.5 → 1.1.6

---

xattr functions mark unwritten bytes as initialized when given a zero-length buffer

GHSA-jh2m-fhpj-3vr7 / RUSTSEC-2026-0486

More information

Details

The extended-attribute functions in rustix::fs (getxattr, lgetxattr, fgetxattr, listxattr, llistxattr and flistxattr) write into a Buffer and then mark as many bytes initialized as the system call reported. When the buffer has zero length, the operating system treats the call as a size query: it writes nothing and returns the size of the attribute value or of the name list. rustix still marked that many bytes as initialized.

Passing a Vec whose length equals its capacity through spare_capacity gives such a zero-length buffer, and rustix then set the vector's length past its capacity over memory that was never written. This is undefined behavior reachable from safe code. With an empty &mut [MaybeUninit<u8>] the call panics instead.

From 1.1.6 these functions return an empty result for a zero-length buffer, and new getxattr_query, lgetxattr_query, fgetxattr_query, listxattr_query, llistxattr_query and flistxattr_query functions return the size. The 0.38 series did not have the Buffer API and is not affected.

Severity

Unknown

References

• https://crates.io/crates/rustix
• https://rustsec.org/advisories/RUSTSEC-2026-0486.html
• https://github.com/bytecodealliance/rustix/commit/8e6aaa6713d2bb64b1fdd8c472e3a32a10a76d70

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

bytecodealliance/rustix (rustix)

v1.1.6

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: cachekit-io/cachekit-rs
• Branch: main
• File: .coderabbit.yaml
• Commit: e3a0123
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 82fdbca7-803e-49fb-bcfe-8f1271cdd17a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Instruction counts: INCOMPLETE

The gate wrote no report: the job stopped before the gate wrote its verdict. See the job log.

PR head 27d82740d6aca685fc25150103b7974272ddebf6 merged into its base, measured against e3a01230d64145f19e14b4e314c7631bf05e2e7a on the same runner. Workflow run