chore(deps): Bump moka from 0.12.15 to 0.12.16

[dependabot]

Bumps moka from 0.12.15 to 0.12.16.

Release notes

Sourced from moka's releases.

v0.12.16

Version 0.12.16

Fixed

• Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592gh-pull-0592 by @​kim-jhyeon, reported in #590gh-issue-0590):
  • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
  • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
  • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

Changed

• Worked around a ThreadSanitizer false positive (#602gh-pull-0602):
  • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
  • std::sync::Arc has a similar workaround.
• Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603gh-pull-0603):
  • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
  • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.

Changelog

Sourced from moka's changelog.

Version 0.12.16

Fixed

• Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592[gh-pull-0592] by [@​kim-jhyeon][gh-kim-jhyeon], reported in #590[gh-issue-0590]):
  • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
  • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
  • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

Changed

• Worked around a ThreadSanitizer false positive (#602[gh-pull-0602]):
  • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
  • std::sync::Arc has a similar workaround.
• Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603[gh-pull-0603]):
  • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
  • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.

Commits

• a616ec1 Merge pull request #604 from moka-rs/chore/bump-v0.12.16
• 3b140a6 Bump the version to v0.12.16
• 51b802d Merge pull request #603 from moka-rs/bump-crossbeam-epoch-floor
• 4f90716 Raise the minimum crossbeam-epoch version to 0.9.20
• 08d0e04 Merge pull request #602 from moka-rs/gh600-tsan-workaround
• 14447a7 Restructure the v0.12.16 TSan workaround CHANGELOG entry
• 7b14c37 Avoid a TSan false positive by replacing the fence in MiniArc::drop
• 05b37c6 Merge pull request #599 from moka-rs/gh590-deterministic-tests
• fc31858 Replace private doc references in gh590 test comments
• 5743592 Improve the v0.12.16 CHANGELOG entry
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)