chore(deps): update rust crate uucore to 0.6.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
uucore	workspace.dependencies	minor	0.2.2 → 0.6.0

---

uucore: safe_traversal TOCTOU protection only enabled on Linux

CVE-2026-35362 / GHSA-w6xc-g9qj-vp32

More information

Details

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

---

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Severity

• CVSS Score: 3.6 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/uutils/coreutils/security/advisories/GHSA-w6xc-g9qj-vp32
• https://nvd.nist.gov/vuln/detail/CVE-2026-35362
• https://github.com/uutils/coreutils/pull/9792
• https://github.com/uutils/coreutils/commit/30239e69a328e76d2377f2a0bc02fbde61c34280
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/advisories/GHSA-w6xc-g9qj-vp32

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

GHSA-fqf6-gxhh-2xhw

More information

Details

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

##### uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created

##### GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #​9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

---

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/uutils/coreutils/security/advisories/GHSA-fqf6-gxhh-2xhw
• https://github.com/uutils/coreutils/pull/9741
• https://github.com/advisories/GHSA-fqf6-gxhh-2xhw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.