chore(deps): update rust crate xxhash-rust to v0.8.16 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
xxhash-rust	workspace.dependencies	patch	0.8.15 → 0.8.16

---

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

GHSA-6g2r-675j-hx59

More information

Details

I have a minimized safe Rust witness for xxhash-rust 0.8.15.

Safe public route:

xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])

The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.

Observed diagnostic:

Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference

Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.

Local artifacts:

• vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
• repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
• report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59
• https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200
• https://github.com/advisories/GHSA-6g2r-675j-hx59

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.