AIKIDO-2026-10622

TL;DR

The LruCache::get_or_insert_mut_ref API had an unconstrained lifetime relationship where the returned &'a mut V was not tied to the borrow lifetime of self. This lets callers hold a mutable reference that can outlive safe access guarantees of the cache internals, creating memory-unsound behavior in safe Rust. In affected versions this can lead to use-after-free style undefined behavior when references are used after cache state changes. The fix changes the method receiver to &'a mut self, correctly binding the returned reference lifetime to the cache borrow.