RUSTSEC-2026-0221: `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`

> `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`

| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unsound |
| Package | `event-listener` |
| Version | `5.4.1` |
| URL | [https://github.com/smol-rs/event-listener/pull/163](https://github.com/smol-rs/event-listener/pull/163) |
| Date | 2026-07-13 |

Affected versions of `event-listener` unconditionally implement `Send` and
`Sync` for `StackSlot<'_, T>`, the stack-allocated listener type created
by the `listener!` macro.

This allows a `!Send` tag type set via `Event::with_tag` to be moved to
another thread and accessed via `StackSlot::wait`, causing a data race in safe
code.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0221.html) for additional details.

The report names event-listener 5.4.1 and links upstream pull request 163; start by checking whether this repository depends on that version and reviewing the advisory. Done means the affected dependency is no longer present at the vulnerable version.

Written by the indexing model from the issue text.