bump crossbeam-epoch from 0.9.18 -> 0.9.20

[arvidn]

address cargo audit issue:

Crate:     crossbeam-epoch
error: 1 vulnerability found!
warning: 10 allowed warnings found
Version:   0.9.18
Title:     Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
Date:      2026-07-06
ID:        RUSTSEC-2026-0204
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0204
Solution:  Upgrade to >=0.9.20

---

Note

Low Risk
Lockfile-only security patch to a transitive concurrency crate; no direct API or business-logic changes in this repo.

Overview
Updates Cargo.lock only, pinning crossbeam-epoch from 0.9.18 to 0.9.20 to clear RUSTSEC-2026-0204 (invalid pointer dereference in fmt::Pointer for Atomic/Shared when the underlying pointer is invalid). No crate manifests or source changes; the crate remains a transitive dependency (e.g. via crossbeam-deque / rayon-core).

^{Reviewed by Cursor Bugbot for commit f87ecc3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• cargo/crossbeam-epoch@0.9.20

View full report

[arvidn]

I reviewed crossbeam's build.rs file.

[arvidn]

@SocketSecurity ignore-all

[coveralls-official]

Coverage Report for CI Build 29017784982

Coverage remained the same at 81.938%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	19671
Covered Lines:	16118
Line Coverage:	81.94%
Coverage Strength:	11508593.03 hits per line

---

💛 - Coveralls

[arvidn]

@SocketSecurity ignore-all