chore(deps): update rust crate crossbeam-channel to 0.5.15 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
crossbeam-channel (source)	dependencies	patch	0.5.14 -> 0.5.15

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-4574

The internal Channel type's Drop method has a race
which could, in some circumstances, lead to a double-free.
This could result in memory corruption.

Quoting from the
upstream description in merge request #​1187:

The problem lies in the fact that dicard_all_messages contained two paths that could lead to head.block being read but only one of them would swap the value. This meant that dicard_all_messages could end up observing a non-null block pointer (and therefore attempting to free it) without setting head.block to null. This would then lead to Channel::drop making a second attempt at dropping the same pointer.

The bug was introduced while fixing a memory leak, in
upstream MR #​1084,
first published in 0.5.12.

The fix is in
upstream MR #​1187
and has been published in 0.5.15

---

Release Notes

crossbeam-rs/crossbeam (crossbeam-channel)

v0.5.15: crossbeam-channel 0.5.15

Compare Source

• Fix regression introduced in 0.5.12 that can lead to a double free when dropping unbounded channel. (#​1187)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.