fix(deps): upgrade lru past RUSTSEC-2026-0253

[andrei-hasna]

Summary

• Upgrade the workspace lru dependency from 0.16.3 to 0.18.2 to resolve RUSTSEC-2026-0253.
• Refresh codex-rs/Cargo.lock and MODULE.bazel.lock.

Verification

• Blacksmith Testbox run 31694852014, exact head 5be860dd32ef76b7af69957a85e723b65f2e2d56: cargo fetch --locked, just bazel-lock-check, and just test-fast -p codex-utils-cache passed.
• Local just bazel-lock-update and just bazel-lock-check passed.
• Local cargo deny check was unavailable because cargo-deny is not installed; the repository cargo-deny workflow will provide the advisory gate.

Task

Fixes hasna/codewith task f9145385-c6bb-42ea-80af-175b2dd99a02.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #586 @ 5be860d — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Scope read

• Compared the exact PR head with origin/main at 3f11b42. The change is limited to MODULE.bazel.lock, codex-rs/Cargo.lock, and codex-rs/Cargo.toml: lru 0.16.3 -> 0.18.2 plus the expected hashbrown 0.17.1, allocator-api2, and equivalent lockfile entries.
• Read the full diff and surrounding codex-utils-cache usage. The code uses LruCache::new, put, get, pop, clear, and unbounded; no incompatible API use or security/data-integrity issue was found.

Commands and gates

• git log --oneline origin/main..HEAD; git diff origin/main...HEAD --stat — exit code 0. One commit; 3 files changed, 8 insertions, 6 deletions.
• bun install — exit code 0. Setup only; not a repository test result.
• This package.json declares no typecheck script and no test script. The repository declares no test gate; I did not invent one.
• gh pr view 586 --repo hasna/codewith --json statusCheckRollup — exit code 0. Forge readback: 43 checks total, 37 SUCCESS, 1 FAILURE, 2 IN_PROGRESS, 3 SKIPPED.
• THE LANE'S CHOSEN COMMAND: cargo metadata --manifest-path codex-rs/Cargo.toml --locked --no-deps — exit code 0. This is not a repository gate.
• THE LANE'S CHOSEN COMMAND: git diff --check — exit code 0. This is not a repository gate.

Forge checks read (name — conclusion)

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• metadata — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — FAILURE
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Build release x86_64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Build release aarch64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-gnu — SUCCESS
• Build release x86_64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox x86_64-apple-darwin — SUCCESS
• Build release aarch64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox aarch64-apple-darwin — SUCCESS
• Build release x86_64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-musl — SUCCESS
• Build release aarch64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox x86_64-pc-windows-msvc from source — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Build ptrcomp-sandbox aarch64-pc-windows-msvc from source — IN_PROGRESS
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking gate

• No concrete code, security, secret, session-integrity, unsafe-mutation, or rollback P0/P1 finding was found in the PR diff.
• The current required forge lane is not green: run 31695002877, job 94430675201, failed Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl. Its log reports fleet_comms::tests::command_fails_open_without_conversations_cli: 126 passed, 1 failed, with a Broken pipe error and process exit code 3. This is outside the PR diff, but it is a currently reachable failure of an applicable required gate, so this exact candidate remains NO_GO until the lane is resolved and read back green.
• The same musl job passed on the fetched main baseline 3f11b42 in Bazel run 31692500063; that makes this look unrelated or flaky, but it does not make the current failed required check pass.

Non-blocking follow-ups

• package.json has no test gate and no typecheck script; this review reports that repository state without inventing either gate.
• The dependency-only diff adds no new regression test; no logic or user-visible behavior changed, so this is non-blocking for this candidate.

Disposition
Leave the PR open. Resolve or re-run the failed required musl lane, then re-read the forge rollup for this exact head before any merge.