From f6c3de4fae64f0dc6f647c8d46f45f34c5580188 Mon Sep 17 00:00:00 2001
From: Kacy Fortner <kacy@kacyfortner.com>
Date: Thu, 26 Feb 2026 21:23:10 -0500
Subject: [PATCH] fix: remove atomic-polyfill by disabling postcard default
 features

postcard's default feature set pulls in heapless 0.7.17 which depends
on atomic-polyfill (RUSTSEC-2023-0089, unmaintained). disabling default
features and keeping only alloc is sufficient for ember-cluster's raft
serialization needs. removes 8 transitive crates; cargo audit now clean.
---
 Cargo.lock                      | 69 ---------------------------------
 crates/ember-cluster/Cargo.toml |  2 +-
 2 files changed, 1 insertion(+), 70 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cdcd340f..18741c1c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -167,15 +167,6 @@ dependencies = [
  "syn 2.0.116",
 ]
 
-[[package]]
-name = "atomic-polyfill"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
-dependencies = [
- "critical-section",
-]
-
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -349,12 +340,6 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -629,12 +614,6 @@ dependencies = [
  "itertools 0.10.5",
 ]
 
-[[package]]
-name = "critical-section"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
-
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.6"
@@ -1277,15 +1256,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "hash32"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
-dependencies = [
- "byteorder",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -1316,20 +1286,6 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
-[[package]]
-name = "heapless"
-version = "0.7.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
-dependencies = [
- "atomic-polyfill",
- "hash32",
- "rustc_version",
- "serde",
- "spin",
- "stable_deref_trait",
-]
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -2013,7 +1969,6 @@ dependencies = [
  "cobs",
  "embedded-io 0.4.0",
  "embedded-io 0.6.1",
- "heapless",
  "serde",
 ]
 
@@ -2467,15 +2422,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "rustc_version"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-dependencies = [
- "semver",
-]
-
 [[package]]
 name = "rustix"
 version = "1.1.3"
@@ -2780,21 +2726,6 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
-[[package]]
-name = "spin"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-dependencies = [
- "lock_api",
-]
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
diff --git a/crates/ember-cluster/Cargo.toml b/crates/ember-cluster/Cargo.toml
index be1f4cf9..12da73f6 100644
--- a/crates/ember-cluster/Cargo.toml
+++ b/crates/ember-cluster/Cargo.toml
@@ -17,7 +17,7 @@ rand = { workspace = true }
 tracing = { workspace = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-postcard = { version = "1", features = ["alloc"] }
+postcard = { version = "1", default-features = false, features = ["alloc"] }
 uuid = { version = "1", features = ["v4", "serde"] }
 openraft = { version = "0.9", features = ["serde"] }
 crc32fast = "1"