Fix native dependency advisories and preserve saved index compatibility

packages/diskgraph/Cargo.toml

@@ -21,6 +21,11 @@ members = [
     "diskgraph-pybind",
 ]
 resolver = "2"
+exclude = ["third_party/epserde"]
+
+[patch.crates-io]
+# Keep the 0.8 index format while removing the unused maligned allocator.
+epserde = { path = "third_party/epserde" }
 
 [workspace.package]
 edition = "2021"
@@ -44,10 +49,10 @@ axum = { version = "0.6", features = ["json"] }
 hyper = { version = "0.14", features = ["full"] }
 http = "0.2"
 bytes = "1.5"
-arrow-array = "58.4.0"
-arrow-buffer = "58.4.0"
-arrow-cast = "58.4.0"
-arrow-schema = "58.4.0"
+arrow-array = "59.3.2"
+arrow-buffer = "59.3.2"
+arrow-cast = "59.3.2"
+arrow-schema = "59.3.2"
 bincode = "1.3"
 parking_lot = "0.12"
 arc-swap = "1"

packages/diskgraph/deny.toml

@@ -10,22 +10,10 @@ targets = [
 all-features = true
 
 # CI runs only `cargo deny check licenses`, so this section is not enforced.
-# It records the advisories accepted on purpose. cargo-deny's default
-# `unsound = "workspace"` scope reports unsound advisories only for direct
-# dependencies, so `cargo deny check advisories` warns `advisory-not-detected`
-# for the transitive maligned entry below. Keep it: cargo-audit and
-# Dependabot do report it.
-#
-# lru (RUSTSEC-2026-0002, RUSTSEC-2026-0253) is not ignored here. It arrives
-# only through ratatui behind the off-by-default TUI features, so it is absent
-# from the shipped artifacts' dependency graphs
-# (third_party/artifact-manifest.json), but it is still in Cargo.lock.
+# The epserde backport removes maligned. The optional terminal tools resolve
+# lru 0.18.2 or newer. Neither finding needs an advisory exception.
 [advisories]
-ignore = [
-    # maligned 0.2.1 comes in through epserde 0.8 and mem_dbg 0.3, under
-    # diskgraph-ptrhash's MPHF index serialization.
-    { id = "RUSTSEC-2023-0017", reason = "maligned::align_first is never called; removing maligned needs an epserde major bump that changes the on-disk index format" },
-]
+ignore = []
 
 [licenses]
 confidence-threshold = 0.93

packages/diskgraph/diskgraph-datagenerator/Cargo.toml

@@ -13,11 +13,11 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
-arrow-array = "58.4.0"
-arrow-schema = "58.4.0"
+arrow-array = "59.3.2"
+arrow-schema = "59.3.2"
 clap = { version = "4.4", features = ["derive"] }
 indicatif = "0.17"
-parquet = { version = "58.4.0", features = ["arrow", "async"] }
+parquet = { version = "59.3.2", features = ["arrow", "async"] }
 chrono = "0.4"
 anyhow = { workspace = true }
 serde = { workspace = true }

packages/diskgraph/diskgraph-engine/Cargo.toml

@@ -14,7 +14,7 @@ diskgraph-index = { path = "../diskgraph-index" }
 diskgraph-rowpack = { path = "../diskgraph-rowpack" }
 arrow-array = { workspace = true }
 arrow-schema = { workspace = true }
-parquet = { version = "58.4.0", features = ["arrow"] }
+parquet = { version = "59.3.2", features = ["arrow"] }
 anyhow = { workspace = true }
 thiserror = { workspace = true }
 half = { workspace = true }
@@ -28,12 +28,10 @@ parking_lot = { workspace = true }
 byteorder = "1.4"
 tempfile = "3.8"
 bincode = "1.3"
-# Terminal UI stack for the developer-only `sampler_tui` binary. Optional and
-# off by default so that ratatui's `lru` dependency, which carries
-# RUSTSEC-2026-0002 and RUSTSEC-2026-0253 and has no release any ratatui 0.2x
-# accepts, stays out of the default build and out of every shipped artifact.
-ratatui = { version = "0.26", optional = true }
-crossterm = { version = "0.27", optional = true }
+# Developer-only terminal interface. Ratatui 0.30.2 accepts lru 0.18.2+,
+# which fixes RUSTSEC-2026-0002 and RUSTSEC-2026-0253.
+ratatui = { version = "0.30.2", optional = true }
+crossterm = { version = "0.29", optional = true }
 clap = { version = "4.4", features = ["derive"] }
 sysinfo = "0.30"
 hdrhistogram = "7.5"
@@ -42,8 +40,8 @@ serde_json = { workspace = true }
 uuid_simd = { package = "uuid-simd", version = "0.8.0", default-features = false, features = ["std"] }
 rayon = "1.11.0"
 uuid = { workspace = true, features = ["v4", "serde"] }
-arrow = "58.4.0"
-arrow-select = "58.4.0"
+arrow = "59.3.2"
+arrow-select = "59.3.2"
 
 [features]
 default = []

packages/diskgraph/diskgraph-engine/src/bin/sampler_tui.rs

@@ -127,7 +127,7 @@ fn main() -> Result<()> {
     Ok(())
 }
 
-async fn run_app<B: ratatui::backend::Backend>(
+async fn run_app<B: ratatui::backend::Backend<Error = std::io::Error>>(
     terminal: &mut Terminal<B>,
     args: Args,
     sampler: Arc<DiskGraphEngine>,
@@ -252,7 +252,7 @@ async fn run_app<B: ratatui::backend::Backend>(
                 .direction(Direction::Vertical)
                 .margin(1)
                 .constraints([Constraint::Length(7), Constraint::Min(0)].as_ref())
-                .split(f.size());
+                .split(f.area());
 
             let text = vec![
                 ratatui::text::Line::from(format!(

packages/diskgraph/diskgraph-explain/Cargo.toml

@@ -27,7 +27,7 @@ diskgraph-index = { path = "../diskgraph-index" }
 diskgraph-core = { path = "../diskgraph-core" }
 diskgraph-rowpack = { path = "../diskgraph-rowpack" }
 
-parquet = "58.4.0"
+parquet = "59.3.2"
 rand = "0.8"
 rayon = "1.10"
 

packages/diskgraph/diskgraph-gateway/Cargo.toml

@@ -13,10 +13,10 @@ diskgraph-core = { path = "../diskgraph-core" }
 diskgraph-engine = { path = "../diskgraph-engine" }
 diskgraph-index = { path = "../diskgraph-index" }
 diskgraph-rowpack = { path = "../diskgraph-rowpack" }
-arrow-flight = "58.4.0"
+arrow-flight = "59.3.2"
 arrow-array = { workspace = true }
 arrow-schema = { workspace = true }
-arrow-ipc = "58.4.0"
+arrow-ipc = "59.3.2"
 tonic = "0.14"
 tokio = { workspace = true }
 tokio-stream = "0.1"

packages/diskgraph/diskgraph-index/examples/write_legacy_index_fixture.rs

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+// All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Run only against the unpatched release dependencies to create the fixtures.
+
+#[path = "../tests/common/mod.rs"]
+mod common;
+
+use epserde::prelude::Serialize;
+use ptr_hash::hash::{GxHash128, PkHash};
+use ptr_hash::{DefaultPtrHash, PtrHashParams, PtrHashScratch};
+use std::path::Path;
+
+macro_rules! write_index {
+    ($name:ident, $hasher:ty, $key:ty, $keys:expr, $root:expr) => {{
+        let keys = $keys;
+        let index = DefaultPtrHash::<$hasher, $key>::try_new_from_source_with_scratch(
+            &keys,
+            PtrHashParams::default(),
+            &mut PtrHashScratch::new(),
+        )
+        .expect("legacy index construction failed");
+        index.store($root.join(concat!(stringify!($name), ".bin")))?;
+        let expected: Vec<_> = keys.0.iter().map(|key| index.index(key)).collect();
+        std::fs::write(
+            $root.join(concat!(stringify!($name), ".json")),
+            serde_json::to_vec_pretty(&expected)?,
+        )?;
+    }};
+}
+
+fn main() -> anyhow::Result<()> {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/epserde-0.8");
+    std::fs::create_dir_all(&root)?;
+    write_index!(pk_int64, PkHash, u64, common::integers(), root);
+    write_index!(pk_bytes, PkHash, Vec<u8>, common::bytes(), root);
+    write_index!(pk_fixed16, PkHash, [u8; 16], common::fixed::<16>(), root);
+    write_index!(pk_fixed32, PkHash, [u8; 32], common::fixed::<32>(), root);
+    write_index!(gx_int64, GxHash128, u64, common::integers(), root);
+    write_index!(gx_bytes, GxHash128, Vec<u8>, common::bytes(), root);
+    write_index!(gx_fixed16, GxHash128, [u8; 16], common::fixed::<16>(), root);
+    write_index!(gx_fixed32, GxHash128, [u8; 32], common::fixed::<32>(), root);
+    Ok(())
+}

packages/diskgraph/diskgraph-index/tests/common/mod.rs

@@ -0,0 +1,48 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+// All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use ptr_hash::{KeySource, KeyT};
+
+pub struct Keys<T>(pub Vec<T>);
+
+impl<T: KeyT> KeySource<T> for Keys<T> {
+    type Iter<'a>
+        = std::slice::Iter<'a, T>
+    where
+        Self: 'a,
+        T: 'a;
+
+    fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    fn iter(&self) -> Self::Iter<'_> {
+        self.0.iter()
+    }
+}
+
+pub fn integers() -> Keys<u64> {
+    Keys((0..64).map(|i| i * 97).collect())
+}
+
+pub fn bytes() -> Keys<Vec<u8>> {
+    Keys(
+        (0..64)
+            .map(|i| format!("legacy-index-long-key-{i:04}").into_bytes())
+            .collect(),
+    )
+}
+
+pub fn fixed<const N: usize>() -> Keys<[u8; N]> {
+    Keys(
+        (0_u8..64)
+            .map(|i| {
+                let mut key = [0; N];
+                key[0] = i;
+                key[N - 1] = 255 - i;
+                key
+            })
+            .collect(),
+    )
+}

packages/diskgraph/diskgraph-index/tests/epserde_compat.rs

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+// All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Read frozen indexes written with the release's unpatched epserde 0.8.0.
+
+mod common;
+
+use epserde::prelude::{Deserialize, Flags, Serialize};
+use ptr_hash::hash::{GxHash128, PkHash};
+use ptr_hash::DefaultPtrHash;
+use std::path::Path;
+
+macro_rules! legacy_index {
+    ($name:ident, $hasher:ty, $key:ty, $keys:expr) => {
+        #[test]
+        fn $name() -> anyhow::Result<()> {
+            type Index = DefaultPtrHash<$hasher, $key>;
+            let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/epserde-0.8");
+            let path = root.join(concat!(stringify!($name), ".bin"));
+            let expected: Vec<usize> = serde_json::from_slice(&std::fs::read(
+                root.join(concat!(stringify!($name), ".json")),
+            )?)?;
+            let keys = $keys;
+            assert_eq!(expected.len(), keys.0.len());
+            let mapped = Index::load_mmap(&path, Flags::empty())?;
+            let memory = Index::load_mem(&path)?;
+            let full = Index::load_full(&path)?;
+            for (key, expected_index) in keys.0.iter().zip(expected) {
+                assert_eq!(mapped.index(key), expected_index, "mmap lookup: {key:?}");
+                assert_eq!(memory.index(key), expected_index, "heap lookup: {key:?}");
+                assert_eq!(full.index(key), expected_index, "full lookup: {key:?}");
+            }
+            let output = tempfile::NamedTempFile::new()?;
+            full.store(output.path())?;
+            assert_eq!(
+                std::fs::read(output.path())?,
+                std::fs::read(path)?,
+                "re-saving a legacy index changes its bytes"
+            );
+            Ok(())
+        }
+    };
+}
+
+legacy_index!(pk_int64, PkHash, u64, common::integers());
+legacy_index!(pk_bytes, PkHash, Vec<u8>, common::bytes());
+legacy_index!(pk_fixed16, PkHash, [u8; 16], common::fixed::<16>());
+legacy_index!(pk_fixed32, PkHash, [u8; 32], common::fixed::<32>());
+legacy_index!(gx_int64, GxHash128, u64, common::integers());
+legacy_index!(gx_bytes, GxHash128, Vec<u8>, common::bytes());
+legacy_index!(gx_fixed16, GxHash128, [u8; 16], common::fixed::<16>());
+legacy_index!(gx_fixed32, GxHash128, [u8; 32], common::fixed::<32>());

packages/diskgraph/diskgraph-index/tests/fixtures/epserde-0.8/README.md

@@ -0,0 +1,11 @@
+# Index compatibility fixtures
+
+These eight files were written before the security backport, with unpatched `epserde 0.8.0` from crates.io. The key index implementation matches the source recorded for Kumo Engine `1.0.0`.
+
+Each index contains 64 keys. The fixtures cover `PkHash` and `GxHash128`. Their key storage types are `u64`, variable byte arrays, 16-byte arrays, and 32-byte arrays. The last two cover the UUID and IP storage shapes.
+
+The JSON files record lookup answers from the original writer. The tests read these fixed answers instead of deriving expected answers from the patched reader. The tests also compare the bytes after loading and saving each index.
+
+[provenance.json](provenance.json) records the source, crate, and fixture file fingerprints. The files were generated on Linux ARM64. They do not establish compatibility with a separate Linux x86_64 build.
+
+The producer is `examples/write_legacy_index_fixture.rs`. Run it only against the unpatched release dependencies when creating replacement fixtures. Do not regenerate these files with the patched library to make a failing compatibility test pass.

packages/diskgraph/diskgraph-index/tests/fixtures/epserde-0.8/gx_bytes.json

@@ -0,0 +1,66 @@
+[
+  42,
+  4,
+  51,
+  31,
+  10,
+  16,
+  49,
+  18,
+  8,
+  5,
+  58,
+  7,
+  38,
+  48,
+  41,
+  25,
+  20,
+  55,
+  14,
+  56,
+  44,
+  45,
+  15,
+  35,
+  1,
+  59,
+  3,
+  30,
+  60,
+  28,
+  23,
+  19,
+  53,
+  11,
+  43,
+  33,
+  0,
+  54,
+  26,
+  17,
+  50,
+  61,
+  34,
+  13,
+  62,
+  9,
+  37,
+  52,
+  12,
+  2,
+  47,
+  46,
+  29,
+  40,
+  21,
+  32,
+  57,
+  6,
+  27,
+  63,
+  36,
+  24,
+  39,
+  22
+]