RUSTSEC-2026-0002: `IterMut` violates Stacked Borrows by invalidating internal pointer

[github-actions]

Details
Package	lru
Version	0.12.5
Warning	unsound
URL	jeromefroe/lru-rs#224
Patched Versions	>=0.16.3
Unaffected Versions	<0.9.0
Aliases	GHSA-rhfx-m35p-ff5j

Affected versions of this crate contain a soundness issue in the IterMut
iterator implementation. The IterMut::next and IterMut::next_back
methods temporarily create an exclusive reference to the key when
dereferencing the internal node pointer.

This invalidates the shared pointer held by the internal HashMap,
violating Stacked Borrows rules.

[ringo380]

This is blocked upstream. mysql_async 0.36.1 depends on lru ^0.14.0, but the fix requires lru >=0.16.3 and no 0.14.x patch exists.

Mitigating factors:

• This is a soundness issue (Stacked Borrows violation), not an exploitable security vulnerability
• The lru crate is only pulled in via the optional mysql feature gate, which is not enabled by default
• Our code does not directly interact with lru::IterMut

Closing as upstream-blocked. Will be resolved when mysql_async updates their lru dependency.