deps: backport lru mutable iterator soundness fix

.github/workflows/ci.yml

@@ -42,6 +42,18 @@ jobs:
           taplo format --check --config taplo.toml
           scripts/fmt.sh --all -- --check
 
+  lru-memory-safety:
+    name: LRU iterator memory safety
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Miri
+        run: rustup toolchain install nightly-2026-08-31 --profile minimal --component miri,rust-src
+      - name: Check both cache implementations
+        run: |
+          cargo +nightly-2026-08-31 miri test --locked -p lru@0.12.5 --test iter_mut
+          cargo +nightly-2026-08-31 miri test --locked -p lru@0.12.5 --no-default-features --test iter_mut
+
   build-and-test-matrix:
     name: 🛠️ Check & Test Matrix
     needs: fast-checks

Cargo.toml

@@ -58,6 +58,7 @@ members = [
 	"pallets/vesting",
 	"pallets/wormhole",
 	"pallets/zk-tree",
+	"patches/lru",
 	"primitives/api-proc-macro",
 	"primitives/consensus/qpow",
 	"primitives/dilithium-crypto",
@@ -370,6 +371,7 @@ frame-system-benchmarking = { path = "./frame/system-benchmarking" }
 frame-system-rpc-runtime-api = { path = "./frame/system-rpc-runtime-api" }
 frame-try-runtime = { path = "./frame/try-runtime" }
 litep2p = { path = "./client/litep2p" }
+lru = { path = "./patches/lru" }
 pallet-transaction-payment = { path = "./pallets/transaction-payment" }
 pallet-transaction-payment-rpc = { path = "./pallets/transaction-payment-rpc" }
 pallet-transaction-payment-rpc-runtime-api = { path = "./pallets/transaction-payment-rpc-runtime-api" }

patches/lru/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+authors = ["Jerome Froelich <jeromefroelic@hotmail.com>"]
+categories = ["caching", "no-std"]
+description = "A LRU cache implementation"
+documentation = "https://docs.rs/lru/"
+edition = "2015"
+homepage = "https://github.com/jeromefroe/lru-rs"
+keywords = ["LRU", "cache"]
+license = "MIT"
+name = "lru"
+readme = "README.md"
+repository = "https://github.com/jeromefroe/lru-rs.git"
+version = "0.12.5"
+
+[features]
+default = ["hashbrown"]
+nightly = ["hashbrown", "hashbrown/nightly"]
+
+[dependencies]
+hashbrown = { version = "0.15", optional = true }
+
+[dev-dependencies]
+scoped_threadpool = "0.1.*"
+stats_alloc = "0.1.*"
+
+[lints]
+workspace = true

patches/lru/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016 Jerome Froelich
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

patches/lru/README.md

@@ -0,0 +1,81 @@
+# LRU Cache
+
+Vendored from crates.io `lru` 0.12.5 (MIT), with the two-line iterator fix from
+[upstream PR #224](https://github.com/jeromefroe/lru-rs/pull/224) backported for
+[RUSTSEC-2026-0002](https://rustsec.org/advisories/RUSTSEC-2026-0002.html).
+Both mutable iterator directions borrow keys through shared pointers. The source
+is formatted with the workspace formatter, with one Clippy allowance on an upstream
+test helper. The public API and version are unchanged.
+
+The root Cargo patch selects this copy for the optional `smoldot-light` dependency.
+That dependency is not enabled in the shipped node or runtime, including release
+v1.0.5. The unaffected `lru` 0.7.8 dependency used by tracing remains on crates.io.
+Version-only scanners may still require a patched-code assessment for this backport.
+
+Run `cargo test --locked -p lru@0.12.5` (also with `--no-default-features`).
+The `iter_mut` integration test covers both iterator directions followed by cache
+lookups; run it under Miri to detect the original pointer invalidation:
+`cargo +nightly miri test -p lru@0.12.5 --test iter_mut`.
+On macOS, set `DYLD_LIBRARY_PATH=''` to avoid the workspace's Homebrew LLVM override.
+
+[![Build Badge]][build status]
+[![Codecov Badge]][coverage status]
+[![crates.io Badge]][crates.io package]
+[![docs.rs Badge]][docs.rs documentation]
+[![License Badge]][license]
+
+[Documentation]
+
+An implementation of a LRU cache. The cache supports `put`, `get`, `get_mut` and `pop` operations,
+all of which are O(1). This crate was heavily influenced by the [LRU Cache implementation in an
+earlier version of Rust's std::collections crate].
+
+The MSRV for this crate is 1.64.0.
+
+## Example
+
+Below is a simple example of how to instantiate and use a LRU cache.
+
+```rust,no_run
+extern crate lru;
+
+use lru::LruCache;
+use std::num::NonZeroUsize;
+
+fn main() {
+    let mut cache = LruCache::new(NonZeroUsize::new(2).unwrap());
+    cache.put("apple", 3);
+    cache.put("banana", 2);
+
+    assert_eq!(*cache.get(&"apple").unwrap(), 3);
+    assert_eq!(*cache.get(&"banana").unwrap(), 2);
+    assert!(cache.get(&"pear").is_none());
+
+    assert_eq!(cache.put("banana", 4), Some(2));
+    assert_eq!(cache.put("pear", 5), None);
+
+    assert_eq!(*cache.get(&"pear").unwrap(), 5);
+    assert_eq!(*cache.get(&"banana").unwrap(), 4);
+    assert!(cache.get(&"apple").is_none());
+
+    {
+        let v = cache.get_mut(&"banana").unwrap();
+        *v = 6;
+    }
+
+    assert_eq!(*cache.get(&"banana").unwrap(), 6);
+}
+```
+
+[build badge]: https://github.com/jeromefroe/lru-rs/actions/workflows/main.yml/badge.svg
+[build status]: https://github.com/jeromefroe/lru-rs/actions/workflows/main.yml
+[codecov badge]: https://codecov.io/gh/jeromefroe/lru-rs/branch/master/graph/badge.svg
+[coverage status]: https://codecov.io/gh/jeromefroe/lru-rs
+[crates.io badge]: https://img.shields.io/crates/v/lru.svg
+[crates.io package]: https://crates.io/crates/lru/
+[documentation]: https://docs.rs/lru/
+[docs.rs badge]: https://docs.rs/lru/badge.svg
+[docs.rs documentation]: https://docs.rs/lru/
+[license badge]: https://img.shields.io/badge/license-MIT-blue.svg
+[license]: https://raw.githubusercontent.com/jeromefroe/lru-rs/master/LICENSE
+[lru cache implementation in an earlier version of rust's std::collections crate]: https://doc.rust-lang.org/0.12.0/std/collections/lru_cache/struct.LruCache.html