From 168c4a3b6f07eb95027711d80e7f45202aedc254 Mon Sep 17 00:00:00 2001
From: stevenhorsman <steven@uk.ibm.com>
Date: Fri, 10 Jul 2026 09:51:37 -0700
Subject: [PATCH] =?UTF-8?q?deps:=20bump=20anyhow=201.0.102=20=E2=86=92=201?=
 =?UTF-8?q?.0.103?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes RUSTSEC-2026-0190 — unsoundness in anyhow::Error::downcast_mut()
in versions < 1.0.103.

We do not call anyhow::Error::downcast_mut() anywhere in the codebase,
so we are not directly exploiting the unsound path, but the bump is
applied to eliminate the advisory from cargo-audit output.

Ref: https://osv.dev/RUSTSEC-2026-0190

Generated-by: IBM Bob
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1a811df9bb..03d1818d24 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -155,9 +155,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "api_client"
diff --git a/Cargo.toml b/Cargo.toml
index 3fa38109f2..15cd5e9d11 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -149,7 +149,7 @@ vsock-exporter = { path = "src/agent/vsock-exporter" }
 
 # Outside dependencies
 actix-rt = "2.7.0"
-anyhow = "1.0"
+anyhow = "1.0.103"
 awaitgroup = "0.7.0"
 base64 = "0.22"
 async-recursion = "0.3.2"