From 69de7b1cea7529dede7d833ec4cdc38c1fad7a3a Mon Sep 17 00:00:00 2001
From: Brendan Molloy <brendan@bbqsrc.net>
Date: Thu, 23 Apr 2026 15:01:51 +0200
Subject: [PATCH 1/2] Gate xattr::set on the xattr feature, not just target_os

src/sync/reader.rs called xattr::set under #[cfg(target_os = "linux")]
alone, but the xattr crate is an optional dep controlled by the xattr
feature (src/fs.rs uses the correct all(..., feature = "xattr") gate).
Downstreams that disable default-features and don't opt into xattr
(e.g. divvunspell) failed to compile on Linux with "cannot find module
or crate `xattr`".

Widen both guards in sync/reader.rs to match src/fs.rs.
---
 src/sync/reader.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/sync/reader.rs b/src/sync/reader.rs
index 9a40ceb..af982be 100644
--- a/src/sync/reader.rs
+++ b/src/sync/reader.rs
@@ -703,7 +703,7 @@ impl BoxReader {
                 }
 
                 // Set xattrs if enabled
-                #[cfg(target_os = "linux")]
+                #[cfg(all(target_os = "linux", feature = "xattr"))]
                 if options.xattrs {
                     for (key, value) in record.attrs_iter(self.metadata()) {
                         if let Some(xattr_name) = key.strip_prefix(crate::attrs::LINUX_XATTR_PREFIX)
@@ -752,7 +752,7 @@ impl BoxReader {
                         .map_err(|e| ExtractError::CreateFileFailed(e, new_file.clone()))?;
                 }
 
-                #[cfg(target_os = "linux")]
+                #[cfg(all(target_os = "linux", feature = "xattr"))]
                 if options.xattrs {
                     for (key, value) in record.attrs_iter(self.metadata()) {
                         if let Some(xattr_name) = key.strip_prefix(crate::attrs::LINUX_XATTR_PREFIX)

From c098064f982be8a02f986a119b2b052709f1cd56 Mon Sep 17 00:00:00 2001
From: Brendan Molloy <brendan@bbqsrc.net>
Date: Thu, 23 Apr 2026 15:32:59 +0200
Subject: [PATCH 2/2] Bump lru to 0.17 for GHSA IterMut Stacked Borrows fix

Affects >= 0.9.0, < 0.16.3. Low severity. lru 0.17 is
API-compatible with how box uses it (LruCache::new + get/put).
---
 Cargo.lock | 35 ++++++++++++++++++++++++++---------
 Cargo.toml |  2 +-
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 54d7f6f..4ecebb8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -305,9 +305,9 @@ dependencies = [
  "digest",
  "fastvint",
  "futures",
- "hashbrown",
+ "hashbrown 0.15.5",
  "hex",
- "lru 0.14.0",
+ "lru 0.17.0",
  "mmap-io",
  "pathdiff",
  "relative-path",
@@ -333,7 +333,7 @@ version = "0.1.0"
 dependencies = [
  "criterion",
  "fastvint",
- "hashbrown",
+ "hashbrown 0.15.5",
  "rand",
 ]
 
@@ -765,6 +765,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "fskitbox"
 version = "0.1.0"
@@ -968,7 +974,18 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
 ]
 
 [[package]]
@@ -1163,16 +1180,16 @@ version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 dependencies = [
- "hashbrown",
+ "hashbrown 0.15.5",
 ]
 
 [[package]]
 name = "lru"
-version = "0.14.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f8cc7106155f10bdf99a6f379688f543ad6596a415375b36a59a054ceda1198"
+checksum = "0e0b564323a0fb6d54b864f625ae139de9612e27edb944dda37c109f05aac531"
 dependencies = [
- "hashbrown",
+ "hashbrown 0.17.0",
 ]
 
 [[package]]
@@ -1838,7 +1855,7 @@ version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
 dependencies = [
- "hashbrown",
+ "hashbrown 0.15.5",
  "serde",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 36e6a2c..b69de9e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -135,7 +135,7 @@ wild = "2.0"
 textwrap = "0.16"
 
 # Other
-lru = "0.14"
+lru = "0.17"
 mmap-io = { version = "0.9.4", features = ["async", "hugepages"] }
 hex = "0.4"
 pathdiff = "0.2"