Update bm25 to v2.3.2 and ignore unmaintained fxhash advisory (#2872)

kensave · kennvene-aws · web-flow · commit 63f022a477c5 · 2025-09-16T10:20:14.000-07:00
- Updated bm25 from v2.2.1 to v2.3.2 (latest version)
- Added RUSTSEC-2025-0057 to deny.toml ignore list for unmaintained fxhash
- fxhash is a transitive dependency of bm25, waiting for upstream migration to rustc-hash

Co-authored-by: Kenneth S. &lt;kennvene@amazon.com&gt;
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/semantic-search-client/Cargo.toml b/crates/semantic-search-client/Cargo.toml
@@ -30,7 +30,7 @@ glob.workspace = true
 hnsw_rs = "=0.3.1"
 
 # BM25 implementation - works on all platforms including ARM
-bm25 = { version = "2.2.1", features = ["language_detection"] }
+bm25 = { version = "2.3.2", features = ["language_detection"] }
 
 # Common dependencies for all platforms
 anyhow = "1.0"
diff --git a/deny.toml b/deny.toml
@@ -27,6 +27,8 @@ ignore = [
   "RUSTSEC-2024-0429",
   # paste is used in core deps
   "RUSTSEC-2024-0436",
+  # fxhash is unmaintained but used by bm25, waiting for bm25 to migrate
+  "RUSTSEC-2025-0057",
 ]
 
 [licenses]

Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,8 @@ ignore = [`
`27`	`27`	`"RUSTSEC-2024-0429",`
`28`	`28`	`# paste is used in core deps`
`29`	`29`	`"RUSTSEC-2024-0436",`
	`30`	`+ # fxhash is unmaintained but used by bm25, waiting for bm25 to migrate`
	`31`	`+ "RUSTSEC-2025-0057",`
`30`	`32`	`]`
`31`	`33`
`32`	`34`	`[licenses]`