Update rkyv to 0.8.13 (Security Fix)

[michalsidzej]

Summary

This PR updates the rkyv dependency from 0.7.42 to 0.8.13 to address a security vulnerability.

Security Advisory

RUSTSEC-2026-0001: Potential Undefined Behavior in Arc<T>/Rc<T> impls of from_value on OOM

The vulnerability involves improper null pointer handling in allocation routines for shared pointer types. When memory allocation fails (OOM), the implementation fails to validate whether the allocator returned a null pointer, which then gets passed to Box::from_raw(), triggering undefined behavior. This can be exploited through safe deserialization APIs like rkyv::from_bytes.

Affected versions: < 0.8.13
Patched versions: >= 0.8.13

Changes

• Bumped rkyv version from 0.7.42 to 0.8.13
• Updated rkyv feature flags: size_32 → pointer_width_32
• Updated rkyv-safe feature: rkyv/validation → rkyv/bytecheck
• Migrated to new rkyv 0.8 attribute syntax:
  • archive(...) → rkyv(...)
  • archive_attr(derive(...)) → rkyv(derive(...))
  • archive(check_bytes) → rkyv(bytecheck())
• Updated test code to use new rkyv 0.8 API

Breaking Changes

None for consumers of this crate. The rkyv integration API remains the same.

[Tony-Samuels]

This introduces a breaking change, and as such cannot be accepted into the v1 branch. rkyv 0.8 is not backwards compatible with rkyv 0.7 usage, so any usage of this crate with rkyv would break.

[Omega359]

How do you plan on resolving the security vulnerability in rkyv if you won't accept the upgrade? This is breaking a number of downstream projects

[Tony-Samuels]

1. This vulnerability only impacts clients using an optional feature. That this is being flagged by audit systems is a bug in those systems.
2. This breakage is in another crate, which can be asked to backport the fix.
3. The only resolution method without an rkyv fix, is to remove support for rkyv 0.7, which this MR does but is a major breaking change for anyone relying on that feature.

I'm afraid our hands are tied here. I do know that a backport has already been requested of the rkyv team, so we'll have to wait for them to respond.

[Tony-Samuels]

This has now been resolved by the rkyv team.

[michalsidzej]

How do you plan on resolving the security vulnerability in rkyv if you won't accept the upgrade? This is breaking a number of downstream projects

theres already a new rkyv 7 version, just run cargo update -p rkyv https://crates.io/crates/rkyv/0.7.46