From 810465edd7463cbc696073eda0965b8995e2d8c5 Mon Sep 17 00:00:00 2001
From: Ranjna Ganesh Ram <ranjnaganeshram694@bitgo.com>
Date: Tue, 7 Jul 2026 13:26:18 +0530
Subject: [PATCH] fix(wasm-utxo): pin crossbeam-epoch to >=0.9.20
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes RUSTSEC-2026-0204 — invalid pointer dereference in fmt::Pointer
impl for Atomic and Shared when the underlying pointer is invalid.
---
 packages/wasm-utxo/Cargo.lock | 5 +++--
 packages/wasm-utxo/Cargo.toml | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/wasm-utxo/Cargo.lock b/packages/wasm-utxo/Cargo.lock
index b3c7d832afa..66fffb4f615 100644
--- a/packages/wasm-utxo/Cargo.lock
+++ b/packages/wasm-utxo/Cargo.lock
@@ -662,9 +662,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -3164,6 +3164,7 @@ version = "0.1.0"
 dependencies = [
  "base64 0.22.1",
  "bech32",
+ "crossbeam-epoch",
  "getrandom 0.2.16",
  "hex",
  "js-sys",
diff --git a/packages/wasm-utxo/Cargo.toml b/packages/wasm-utxo/Cargo.toml
index 9e36973bce1..94ce590a19e 100644
--- a/packages/wasm-utxo/Cargo.toml
+++ b/packages/wasm-utxo/Cargo.toml
@@ -38,6 +38,9 @@ serde = { version = "1.0", features = ["derive"], optional = true }
 serde_json = { version = "1.0", optional = true }
 hex = { version = "0.4", optional = true }
 
+# Pinned to avoid RUSTSEC-2026-0204 (invalid pointer dereference in fmt::Pointer)
+crossbeam-epoch = ">=0.9.20"
+
 [dev-dependencies]
 base64 = "0.22.1"
 serde = { version = "1.0", features = ["derive"] }