chore(deps): bump lru from 0.18.2 to 0.18.3

[dependabot]

Bumps lru from 0.18.2 to 0.18.3.

Changelog

Sourced from lru's changelog.

v0.18.3 - 2026-08-27

• Add sparse constructor.

Commits

• ceeee6a Merge pull request #244 from jeromefroe/jerome/prepare-0-18-3-release
• 1810d9a Prepare 0.18.3 release
• 0f4e37a Merge pull request #242 from drbrain/LruCache-sparse
• f1c04a2 Merge pull request #243 from jeromefroe/jerome/nonnull-unchecked-on-box-ptr
• bcd5722 fmt
• fa08c36 Prefer into_raw over leak
• 8a93408 fmt
• 043384f Fix nonnull_unchecked_on_box_ptr lint
• ea63d70 Add LruCache::sparse()
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Thanks @dependabot[bot] for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[claude]

Claude finished @Hmbown's task in 36s —— View job

---

Reviewing PR #5876 — chore(deps): bump lru 0.18.2 → 0.18.3

• Gather context (diff, changed files)
• Understand request (dependabot lockfile bump — review for correctness/safety/reuse/tests/security)
• Execute review
• Post final summary

Summary

This PR only updates Cargo.lock (version + checksum for the lru crate, 0.18.2 → 0.18.3). No application source files are touched.

• Correctness: N/A — no code changes.
• Provider/model/route safety: N/A — unrelated to routing/provider logic.
• Reuse/simplification: N/A.
• Tests: N/A — a patch-level lockfile bump doesn't need new tests.
• Security: Upstream changelog for 0.18.3 only adds a sparse() constructor (see jeromefroe/lru-rs CHANGELOG) — purely additive, no known advisories.

I checked the three consumers of LruCache in this repo (crates/tui/src/tools/web/cache.rs, crates/tui/src/regex_cache.rs, crates/tui/src/llm_response_cache.rs) — none use anything affected by this bump.

Verdict: LGTM, safe to merge as a routine dependency update. No changes requested.

Note: this repo's PR intake gate is in dry-run mode per the earlier bot comment — a maintainer may still want to /lgtm this to keep future dependabot PRs from getting the same notice.

[codewhale-agent]

Codewhale review

Dependabot updates Cargo.lock to raise lru from 0.18.2 to 0.18.3. The patch release adds a sparse constructor and a lint fix, with no source changes in this PR.

Findings

• [INFO] Lockfile-only update; confirm manifest compatibility (Cargo.lock:3020)
  Only Cargo.lock is changed. This is expected if the Cargo.toml requirement (e.g. lru = "0.18" or lru = "0.18.2") already permits 0.18.3. Verify that the manifest does not pin an exact older version and rely on CI for build/test validation.

Assessment

Safe semver-compatible patch bump. No application code or tests are affected; the lockfile changes are appropriate for the 0.18.3 release.

---

Advisory review by Codewhale (codewhale review --pr 5876 --post, head 4e145338883218b7a9c0cba6e73d36579f10120e). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.

[codewhale-agent]

[INFO] Lockfile-only update; confirm manifest compatibility

Only Cargo.lock is changed. This is expected if the Cargo.toml requirement (e.g. lru = "0.18" or lru = "0.18.2") already permits 0.18.3. Verify that the manifest does not pin an exact older version and rely on CI for build/test validation.

[claude]

Claude finished @Hmbown's task in 41s —— View job

---

Reviewing PR #5876 — chore(deps): bump lru 0.18.2 → 0.18.3

• Gather context (diff, manifest, lockfile)
• Understand request (dependabot lockfile bump — review for correctness/safety/reuse/tests/security)
• Execute review
• Post final summary

Summary

Lockfile-only change (Cargo.lock:3018-3021, lru 0.18.2 → 0.18.3, checksum updated). No source files touched.

• Correctness: N/A — no code changes.
• Manifest compatibility (resolves the earlier INFO finding): crates/tui/Cargo.toml:103 declares lru = "0.18", with a comment noting lru >= 0.18.2 is required to fix RUSTSEC-2026-0253 (panic-unsafe pop()). 0.18.3 satisfies both the semver range and the RUSTSEC floor, so this is a safe, in-range patch bump.
• Provider/model/route safety: N/A — unrelated.
• Reuse/simplification: N/A. Confirmed only one lru entry in Cargo.lock (no duplicate/diamond version pulled in transitively).
• Tests: N/A for a patch bump; no new public API is consumed.
• Security: Upstream 0.18.3 changelog only adds an LruCache::sparse() constructor and a lint fix — purely additive, no advisories, and it stays above the RUSTSEC-2026-0253 floor already pinned in crates/tui/Cargo.toml.

Checked the repo's LruCache consumers (crates/tui/src/tools/web/cache.rs, crates/tui/src/regex_cache.rs, crates/tui/src/llm_response_cache.rs) — none touch the new sparse() constructor or anything else affected by this release.

Verdict: LGTM, safe to merge as a routine dependency update. No changes requested.

[codewhale-agent]

Codewhale review

This PR bumps the lru crate from 0.18.2 to 0.18.3 in Cargo.lock. The only change is the version and checksum; no source code changes are included.

Assessment

Looks correct: Cargo.lock is consistent with the described dependency upgrade and no code changes or tests are required for this lockfile-only update.

---

Advisory review by Codewhale (codewhale review --pr 5876 --post, head 9e81f9bf9227b330930bf1956afee46a9249e4b8). Line-specific findings are also posted as inline review comments; mechanical fixes arrive as committable suggestions you can apply from the Files tab. CODEOWNERS approval still governs merge.