RUSTSEC-2023-0089: atomic-polyfill is unmaintained

[github-actions]

Details
Package	atomic-polyfill
Version	1.0.3
Warning	unmaintained
URL	embassy-rs/atomic-polyfill@48e55c1
Patched Versions	n/a

The author has archived the GitHub repository and mentions deprecation in
project's
README.

Possible alternatives

• portable-atomic

[traycerai]

Plan

Observations

The atomic-polyfill dependency is not directly used by DaemonEye but is pulled in transitively through postcard 1.1.3 → heapless 0.7.17 → atomic-polyfill. The codebase uses postcard extensively for binary serialization across eventbus, RPC, WAL, and task distribution components. The deny.toml currently ignores RUSTSEC-2023-0089, noting that upstream postcard has merged heapless 0.9 support but hasn't released version 1.2+ yet. The heapless 0.9.x series uses portable-atomic instead of the unmaintained atomic-polyfill.

Approach

Use Cargo's dependency patching mechanism to override the heapless dependency version from 0.7.x to 0.9.x. This will transitively replace atomic-polyfill with portable-atomic without waiting for postcard 1.2+ release. This approach is a temporary workaround that maintains compatibility while addressing the security advisory. The patch will be applied at the workspace level and should be removed once postcard officially releases with heapless 0.9 support.

Implementation Steps

1. Apply Dependency Patch

File: file:Cargo.toml

Add a [patch.crates-io] section after the workspace dependencies section (around line 156) to override the heapless version:

[patch.crates-io]
# Override heapless to 0.9.x to replace atomic-polyfill with portable-atomic
# This is a temporary workaround until postcard 1.2+ releases with native heapless 0.9 support
# Tracking: https://github.com/jamesmunns/postcard/issues/223
heapless = "0.9"

2. Update Security Configuration

File: file:deny.toml

Remove the RUSTSEC-2023-0089 advisory from the ignore list (lines 100-105):

• Delete the comment block and advisory ID for atomic-polyfill
• Keep the bincode advisory (RUSTSEC-2025-0141) as it's unrelated

The ignore array should only contain:

ignore = [
    "RUSTSEC-2025-0141",  # bincode - keep this
    # Remove RUSTSEC-2023-0089 entry
]

3. Verify Dependency Resolution

Run dependency verification commands to ensure the patch is applied correctly:

cargo tree -p heapless
cargo tree -p atomic-polyfill
cargo tree -p portable-atomic

Expected outcome:

• heapless should resolve to version 0.9.x
• atomic-polyfill should not appear in the dependency tree
• portable-atomic should appear as a dependency of heapless

4. Comprehensive Testing

Execute the full test suite to verify postcard serialization/deserialization works correctly with heapless 0.9:

Test areas to focus on:

• file:daemoneye-eventbus/tests/rpc_integration_tests.rs - RPC serialization tests
• file:collector-core/tests/daemoneye_eventbus_ipc_integration.rs - IPC integration tests
• file:collector-core/tests/rpc_server_integration.rs - RPC server tests
• file:daemoneye-eventbus/benches/throughput.rs - Serialization benchmarks
• file:procmond/src/wal.rs - WAL serialization tests

Run commands:

cargo test --workspace
cargo test --workspace --all-features
cargo bench --no-run  # Verify benchmarks compile

5. Security Audit Verification

Run security audit tools to confirm the advisory is resolved:

cargo deny check advisories
cargo audit

Expected outcome: No warnings about RUSTSEC-2023-0089 or atomic-polyfill

6. Documentation Update

File: file:deny.toml

Add a comment above the [patch.crates-io] section explaining the temporary nature of this workaround:

# Temporary patch to use heapless 0.9.x (with portable-atomic) instead of 0.7.x (with atomic-polyfill)
# until postcard 1.2+ is released with native heapless 0.9 support.
# TODO: Remove this patch when postcard 1.2+ is released
# Tracking: https://github.com/jamesmunns/postcard/issues/223

7. Cross-Platform Verification

Test on all supported platforms defined in file:deny.toml (lines 5-11):

• aarch64-apple-darwin (macOS ARM)
• aarch64-unknown-linux-gnu (Linux ARM)
• x86_64-unknown-linux-gnu (Linux x64)
• x86_64-unknown-linux-musl (Linux x64 musl)
• x86_64-pc-windows-msvc (Windows x64)

Verify builds succeed:

cargo check --target <target-triple>

8. Monitor for Upstream Release

Set up monitoring for postcard 1.2+ release:

• Watch the GitHub repository: https://github.com/jamesmunns/postcard
• Monitor issue #223 for release announcements
• When released, remove the [patch.crates-io] section and update postcard to 1.2+

Dependency Flow Diagram

graph TD
    A[DaemonEye Workspace] --> B[postcard 1.1.3]
    B --> C[heapless 0.7.x]
    C --> D[atomic-polyfill ❌]
    
    A2[DaemonEye Workspace<br/>with patch] --> B2[postcard 1.1.3]
    B2 -.patch.-> C2[heapless 0.9.x]
    C2 --> D2[portable-atomic ✅]
    
    style D fill:#ffcccc
    style D2 fill:#ccffcc

Loading

Risk Assessment

Low Risk: The patch overrides a transitive dependency version within the same major version series (0.7 → 0.9). Heapless maintains API stability, and postcard upstream has already tested compatibility with heapless 0.9 (merged PR #269). The extensive test suite will catch any incompatibilities.

Rollback Plan: If issues arise, remove the [patch.crates-io] section and restore the RUSTSEC-2023-0089 ignore entry in file:deny.toml.

Import In IDE

🤖 Prompt for AI Agents

## Observations

The `atomic-polyfill` dependency is not directly used by DaemonEye but is pulled in transitively through `postcard 1.1.3 → heapless 0.7.17 → atomic-polyfill`. The codebase uses postcard extensively for binary serialization across eventbus, RPC, WAL, and task distribution components. The `deny.toml` currently ignores RUSTSEC-2023-0089, noting that upstream postcard has merged heapless 0.9 support but hasn't released version 1.2+ yet. The heapless 0.9.x series uses `portable-atomic` instead of the unmaintained `atomic-polyfill`.

## Approach

Use Cargo's dependency patching mechanism to override the heapless dependency version from 0.7.x to 0.9.x. This will transitively replace `atomic-polyfill` with `portable-atomic` without waiting for postcard 1.2+ release. This approach is a temporary workaround that maintains compatibility while addressing the security advisory. The patch will be applied at the workspace level and should be removed once postcard officially releases with heapless 0.9 support.

## Implementation Steps

### 1. Apply Dependency Patch

**File**: `file:Cargo.toml`

Add a `[patch.crates-io]` section after the workspace dependencies section (around line 156) to override the heapless version:

```toml
[patch.crates-io]
# Override heapless to 0.9.x to replace atomic-polyfill with portable-atomic
# This is a temporary workaround until postcard 1.2+ releases with native heapless 0.9 support
# Tracking: https://github.com/jamesmunns/postcard/issues/223
heapless = "0.9"
```

### 2. Update Security Configuration

**File**: `file:deny.toml`

Remove the RUSTSEC-2023-0089 advisory from the ignore list (lines 100-105):

- Delete the comment block and advisory ID for `atomic-polyfill`
- Keep the bincode advisory (RUSTSEC-2025-0141) as it's unrelated

The ignore array should only contain:
```toml
ignore = [
    "RUSTSEC-2025-0141",  # bincode - keep this
    # Remove RUSTSEC-2023-0089 entry
]
```

### 3. Verify Dependency Resolution

Run dependency verification commands to ensure the patch is applied correctly:

```bash
cargo tree -p heapless
cargo tree -p atomic-polyfill
cargo tree -p portable-atomic
```

Expected outcome:
- `heapless` should resolve to version 0.9.x
- `atomic-polyfill` should not appear in the dependency tree
- `portable-atomic` should appear as a dependency of heapless

### 4. Comprehensive Testing

Execute the full test suite to verify postcard serialization/deserialization works correctly with heapless 0.9:

**Test areas to focus on**:
- `file:daemoneye-eventbus/tests/rpc_integration_tests.rs` - RPC serialization tests
- `file:collector-core/tests/daemoneye_eventbus_ipc_integration.rs` - IPC integration tests
- `file:collector-core/tests/rpc_server_integration.rs` - RPC server tests
- `file:daemoneye-eventbus/benches/throughput.rs` - Serialization benchmarks
- `file:procmond/src/wal.rs` - WAL serialization tests

Run commands:
```bash
cargo test --workspace
cargo test --workspace --all-features
cargo bench --no-run  # Verify benchmarks compile
```

### 5. Security Audit Verification

Run security audit tools to confirm the advisory is resolved:

```bash
cargo deny check advisories
cargo audit
```

Expected outcome: No warnings about RUSTSEC-2023-0089 or atomic-polyfill

### 6. Documentation Update

**File**: `file:deny.toml`

Add a comment above the `[patch.crates-io]` section explaining the temporary nature of this workaround:

```toml
# Temporary patch to use heapless 0.9.x (with portable-atomic) instead of 0.7.x (with atomic-polyfill)
# until postcard 1.2+ is released with native heapless 0.9 support.
# TODO: Remove this patch when postcard 1.2+ is released
# Tracking: https://github.com/jamesmunns/postcard/issues/223
```

### 7. Cross-Platform Verification

Test on all supported platforms defined in `file:deny.toml` (lines 5-11):
- aarch64-apple-darwin (macOS ARM)
- aarch64-unknown-linux-gnu (Linux ARM)
- x86_64-unknown-linux-gnu (Linux x64)
- x86_64-unknown-linux-musl (Linux x64 musl)
- x86_64-pc-windows-msvc (Windows x64)

Verify builds succeed:
```bash
cargo check --target <target-triple>
```

### 8. Monitor for Upstream Release

Set up monitoring for postcard 1.2+ release:
- Watch the GitHub repository: https://github.com/jamesmunns/postcard
- Monitor issue #223 for release announcements
- When released, remove the `[patch.crates-io]` section and update postcard to 1.2+

## Dependency Flow Diagram

```mermaid
graph TD
    A[DaemonEye Workspace] --> B[postcard 1.1.3]
    B --> C[heapless 0.7.x]
    C --> D[atomic-polyfill ❌]
    
    A2[DaemonEye Workspace<br/>with patch] --> B2[postcard 1.1.3]
    B2 -.patch.-> C2[heapless 0.9.x]
    C2 --> D2[portable-atomic ✅]
    
    style D fill:#ffcccc
    style D2 fill:#ccffcc
```

## Risk Assessment

**Low Risk**: The patch overrides a transitive dependency version within the same major version series (0.7 → 0.9). Heapless maintains API stability, and postcard upstream has already tested compatibility with heapless 0.9 (merged PR #269). The extensive test suite will catch any incompatibilities.

**Rollback Plan**: If issues arise, remove the `[patch.crates-io]` section and restore the RUSTSEC-2023-0089 ignore entry in `file:deny.toml`.

---

Execution Information

Branch: main
Commit: 38a8872

---

💡 Tips

Supported Commands (Inside Comments)

• Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

• Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
• Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[unclesp1d3r]

Tracked in Jira: END-281

This issue stays open in GitHub for tactical work. Planning happens in Jira.