fix(deps): clear the 2026-10-23 constant-time and npm advisories by chaliy · Pull Request #2773 · everruns/bashkit

chaliy · 2026-10-24T09:44:07Z

What changed

Six advisories published 2026-10-23 are cleared by moving four dependency versions. No bashkit behaviour changes and no suppression is added.

Advisory	Crate / package	Move
RUSTSEC-2026-0385	ctutils	0.4.2 → 0.4.5
RUSTSEC-2026-0387	crypto-bigint	0.7.5 → 0.7.6
GHSA-mrhx-c7xc-m3w5 (high)	zod	4.5.4 → 4.6.7
GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h	fast-uri	3.1.8 → 3.1.9

ctutils is in three lockfiles that resolve it independently (Cargo.lock, crates/bashkit/fuzz/Cargo.lock, examples/hyperlight/Cargo.lock), so all three move. crypto-bigint 0.7.6 requires ctutils ≥ 0.4.5, so the two Rust bumps cannot land apart.

The npm fixes are pnpm.overrides because the vulnerable versions are transitive and pinned by their parents: @astrojs/sitemap 3.7.4 holds zod at 4.5.4 while astro itself already resolves 4.6.7, so the override also dedupes the two copies to one. fast-uri was already overridden at a ^3.1.8 floor; that floor moves up.

Why

Nightly run 276 went red on Advisory Audit, and main would have followed on its next push — the scan reads every lockfile in the tree regardless of the diff, so an advisory against unchanged code reddens everything. This is the scheduled-scan case scripts/audit-lockfiles.sh exists for.

Exposure is modest in both ecosystems, which is why this is a lockfile change and not a hardening one. Both Rust crates reach bashkit only through the opt-in ssh feature, as russh → rsa / ssh-key / elliptic-curve, and neither is reachable from a default build. The npm pair is site build tooling and ships in no published artifact.

cargo-vet

ctutils gains a reviewed delta audit. The fix is small and readable. Every Choice::to_*_mask now negates to_u8() instead of reading the inner byte, so the black_box barrier stops being bypassed on the mask path, and from_u128_lt/from_u128_le use half-width u64 predicates on 32-bit targets, where full-width subtraction let LLVM lower the comparison to a short-circuiting multiword branch. The comparison macros move verbatim into a new primitives module. The rest is MSRV-1.87 follow-through (cast_signed/cast_unsigned, const fn, two *_vartime methods deprecated). #[forbid(unsafe_code)] holds and no dependency is added.

crypto-bigint moves its exemption instead. That delta is 3116 lines across ~60 source files — four Security entries and eight Fixed entries, a constant-time sweep across the limb, Montgomery, gcd and sqrt paths. A delta audit would claim a review that diff does not get, so the exemption moves 0.7.5 → 0.7.6, the same call made for the rustyline major bump in #2765. What the delta was checked for instead: unsafe occurrences unchanged at 32, no runtime dependency added (num-bigint and num-modular are dev-only), and MSRV 1.85 → 1.87 plus resolver 2 → 3 both inside the pinned 1.95 toolchain.

No new suppression, so deny.toml and the threat model's suppressed-advisory list are untouched.

Before / After

No observable behaviour change in bashkit or on the site — this is a dependency-version change. The observable change is the scan itself.

Before (nightly run 276, Advisory Audit):

error: 1 vulnerability found!
Crate:    ctutils
Version:  0.4.2
Title:    Non-constant-time mask generation and `u128` comparisons
ID:       RUSTSEC-2026-0385
Solution: Upgrade to >=0.4.4
...
./site: 5 advisories
  high  zod <4.6.6  GHSA-mrhx-c7xc-m3w5
    Zod can exhaust memory while validating oversized constrained collections
  moderate  fast-uri >=3.0.0 <3.1.9  GHSA-w74x-v6f9-j3xg
  ...
##[error]Process completed with exit code 1.

After (scripts/audit-lockfiles.sh, cargo-audit 0.22.2, exit 0):

::group::cargo audit ./Cargo.lock
warning: 2 allowed warnings found      # pre-existing atomic-polyfill + clipboard-win
::group::cargo audit ./crates/bashkit/fuzz/Cargo.lock
::group::cargo audit ./examples/hyperlight/Cargo.lock
warning: 1 allowed warning found       # pre-existing tokio RUSTSEC-2026-0386 (unsound)
::group::cargo audit ./examples/hyperlight/host/Cargo.lock
./site: no known vulnerabilities found
./examples/docs-grep-agent/uv.lock: no known vulnerabilities found (47 packages)

Only pre-existing allowed warnings remain. Note the local scan needs cargo-audit ≥ 0.22: 0.21.x aborts on the CVSS 4.0 advisories now in the database, which looks like a clean scan but audits nothing. CI's taiki-e/install-action already pulls a current build.

Other validation:

cargo vet --locked → Vetting Succeeded (98 fully audited, 85 partially audited, 493 exempted)
just pre-pr → Pre-PR checks passed (fmt, clippy -D warnings, test suite, 179 Python script tests, capability parity, OKF 46 concepts, 204 doc links, workflow parity, changelog)
cargo test --features ssh -p bashkit --test ssh_builtin_tests → 24 passed, the one slice that actually links both bumped crates
cargo build --workspace --features http_client,ssh,sqlite → clean
pnpm run build in site/ → 45 pages, all 11 postbuild verifications pass on zod 4.6.7 and fast-uri 3.1.9

Risk

Low. Lockfile and override changes only; no bashkit source changes.
What could break: the zod override forces @astrojs/sitemap off its pinned 4.5.4 onto 4.6.7. That is the one place a parent's pin is overridden rather than raised, so it is verified by a full site build — sitemap generation included (sitemap.xml written with 45 entries, verify-sitemap.mjs passing). Site CI re-runs this on the PR.
crypto-bigint's exemption move carries the usual exemption caveat: the 0.7.6 delta is not reviewed line by line, only checked for unsafe growth, new dependencies and MSRV.

Checklist

Tests added or updated — no new tests; a dependency-version change with no new code path. Covered by the existing advisory scan, which is the regression test for this class and is what caught it.
Backward compatibility considered — no API or behaviour change; both Rust crates are transitive and behind the opt-in ssh feature.

https://claude.ai/code/session_01HdvvSy3syHMpdcpW5Ushhd

Generated by Claude Code

Nightly run 276 went red on `Advisory Audit` and main would have followed on its next push: the scan reads every lockfile in the tree regardless of the diff, and three advisory sets landed against code that has not changed. - RUSTSEC-2026-0385, ctutils 0.4.2 -> 0.4.5. Non-constant-time mask generation and `u128` comparisons. Present in `Cargo.lock`, `crates/bashkit/fuzz/Cargo.lock` and `examples/hyperlight/Cargo.lock`, which resolve it independently. - RUSTSEC-2026-0387, crypto-bigint 0.7.5 -> 0.7.6. Multiple timing variability issues in operations intended to be constant-time. Root lockfile only. 0.7.6 requires ctutils >= 0.4.5, so the two bumps have to move together. - site npm: zod < 4.6.6 (GHSA-mrhx-c7xc-m3w5, high: memory exhaustion validating oversized constrained collections) and fast-uri < 3.1.9 (four advisories: scheme injection, scheme spoofing, host confusion, path equivalence). Both Rust crates reach bashkit only through the opt-in `ssh` feature, as russh -> rsa / ssh-key / elliptic-curve, and neither is reachable from a default build. The npm pair is site build tooling and ships in no published artifact. The npm fixes are overrides because the vulnerable versions are transitive and pinned by their parents: `@astrojs/sitemap` 3.7.4 holds zod at 4.5.4 while astro itself already resolves 4.6.7, so the override also dedupes the two copies to one. `fast-uri` was already overridden at a `^3.1.8` floor; that floor moves to `^3.1.9`. cargo-vet: - ctutils gains a reviewed delta audit. The fix is small and readable: every `Choice::to_*_mask` now negates `to_u8()` instead of the inner byte, so the `black_box` barrier stops being bypassed on the mask path, and the `u128` comparisons use half-width `u64` predicates on 32-bit targets. The rest is MSRV-1.87 follow-through. `#![forbid(unsafe_code)]` holds and no dependency is added. - crypto-bigint moves its exemption 0.7.5 -> 0.7.6 rather than claiming a delta review. The delta is 3116 lines across ~60 source files -- four Security entries and eight Fixed entries, a constant-time sweep across limb, Montgomery, gcd and sqrt paths. Writing a delta audit here would claim a review that diff does not get. The crate was exempted, not audited, so the exemption moves, as it did for the rustyline major bump in #2765. `unsafe` occurrences are unchanged at 32 and no runtime dependency is added (num-bigint and num-modular are dev-only); MSRV 1.85 -> 1.87 and resolver 2 -> 3 both stay inside the pinned 1.95 toolchain. No suppression is added, so `deny.toml` and the threat model's suppressed- advisory list are untouched. No behaviour change in bashkit or on the site. Verified: `scripts/audit-lockfiles.sh` exits 0 over all ten lockfiles (cargo-audit 0.22.2 -- 0.21.x cannot parse the CVSS 4.0 advisories now in the database), `cargo vet --locked` succeeds, and the site builds with zod 4.6.7 and fast-uri 3.1.9 with all eleven postbuild verifications passing. Claude-Session: https://claude.ai/code/session_01HdvvSy3syHMpdcpW5Ushhd

cloudflare-workers-and-pages · 2026-10-24T09:44:43Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	`ce54196`	Commit Preview URL Branch Preview URL	Oct 24 2026, 09:44 AM

`Audit` failed on the bump with `vt100:0.18.1 missing ["safe-to-deploy"]`: the 0.16.2 exemption does not carry across versions. Move the exemption rather than add a delta audit. That delta is ~3100 lines across a dozen files plus a new `capture.rs`, so a delta audit would claim a review that diff does not get -- the same call #2773 made for crypto-bigint. Checked instead for what the exemption actually asserts, and all of it still holds: - zero `unsafe` anywhere in src, unchanged from 0.16.2 - zero use of `std::fs`, `std::net`, `std::process` or `std::env` - no new runtime dependency: 0.18.1 adds only an optional `embedded-io`, which stays unenabled and does not appear among vt100's resolved deps in Cargo.lock (itoa, unicode-width, vte); vte stays at 0.15.0 Also keep the lockfile delta to the vt100 entry alone. `cargo update -p vt100` additionally moved tempfile from getrandom 0.3.4 to 0.4.3, which this change has no reason to carry; main's lockfile is not stale (`cargo metadata --locked` passes on it), so that was opportunistic re-resolution. The lockfile now changes two lines and still validates under `--locked`. Verified: `cargo vet --locked` succeeds (98 fully audited, 86 partially audited, 492 exempted); fmt clean; the same terminal test slice passes `--locked` with 0 failures.

…2789) Supersedes Dependabot #2786, which bumped the version alone and failed 28 jobs: vt100 0.18 takes and returns screen dimensions as `NonZero<u16>` where 0.16 used `u16`, so the bump needs a source change Dependabot cannot make. `TerminalSize` keeps plain `u16` fields -- they are public API, and nothing about this upgrade justifies breaking callers -- so the conversion lives at the vt100 boundary only, in the six call sites across `terminal/tty.rs` and `terminal/mod.rs`. Zero needs a decision, since `NonZero` cannot carry it. `TerminalSize::new` clamps each dimension to 2, but the struct's fields are public and can be set literally, so a zero can still arrive. It clamps to 1 rather than panicking: a degenerate size is the caller's to notice and not worth aborting a session over, and 0.16 accepted it without complaint. No behaviour change for any non-zero size, and no public API change. Moves the cargo-vet exemption to 0.18.1 rather than adding a delta audit: the delta is ~3100 lines across a dozen files plus a new capture.rs, so a delta audit would claim a review that diff does not get -- the call #2773 made for crypto-bigint. Checked what the exemption asserts instead, and it all holds: zero `unsafe` in src (unchanged from 0.16.2), zero use of std::fs, std::net, std::process or std::env, and no new runtime dependency, since 0.18.1's new `embedded-io` is optional and absent from vt100's resolved deps. The lockfile delta is the vt100 entry alone. `cargo update -p vt100` also moved tempfile from getrandom 0.3.4 to 0.4.3, which this change has no reason to carry; main's lockfile is not stale, so that was opportunistic re-resolution and is left out. Verified: 52 checks green; locally cargo vet --locked succeeds, fmt and clippy --all-targets are clean on the terminal feature, and the terminal test slice passes --locked with 0 failures.

…lockfileNightly run 285 went red on `Advisory Audit`, and main would have followed on its next push: the scan reads every lockfile regardless of the diff, so an advisory against unchanged code reddens everything.Two moderate advisories against seroval 1.6.8, both published against code that has not changed here:- GHSA-9wx9-5pv9-3349, script injection through RegExp sources in serialized output (>=1.5.5 <1.6.10). - GHSA-f86p-h4j2-7qgj, code injection through a typed array's own constructor property (>=1.6.0 <1.6.11).seroval is transitive and pinned by its parent -- asciinema-player 3.17.0 -> solid-js 1.9.16 -> seroval -- so it moves as a `pnpm.overrides` floor, the same way zod and fast-uri did in #2773.Floored to `>=1.6.11 <1.7.0`, which resolves 1.6.12. Both advisories clear at 1.6.11, and holding the upper bound at the current minor keeps this a patch move on a serializer that solid-js uses for SSR hydration; 1.7.3 exists and satisfies solid-js's `^1.0` range, but nothing about clearing these advisories justifies a minor bump there. Matches the existing `sharp` floor's shape.The lockfile delta is the seroval entry and the three references to it, and nothing else; `pnpm install --lockfile-only` moved no other package, so there is no opportunistic re-resolution to carry.No suppression added, so deny.toml and the threat model's suppressed-advisory list are untouched. npm-only, so no supply-chain audit applies. No behaviour change in bashkit or on the site.Verified: the site advisory scan goes from the two findings above to "no known vulnerabilities found", and the other four pnpm lockfiles and the uv lockfile are clean. The site builds on seroval 1.6.12 -- 45 pages, all eleven postbuild verifications pass -- on Node 22.23.4, the version js.yml pins. 185/185 script tests, doc links, OKF and workflow parity all pass. No Cargo.lock changed.

…lockfile (#2795) Nightly run 285 went red on `Advisory Audit`, and main would have followed on its next push: the scan reads every lockfile regardless of the diff, so an advisory against unchanged code reddens everything. Two moderate advisories against seroval 1.6.8, both published against code that has not changed here: - GHSA-9wx9-5pv9-3349, script injection through RegExp sources in serialized output (>=1.5.5 <1.6.10). - GHSA-f86p-h4j2-7qgj, code injection through a typed array's own constructor property (>=1.6.0 <1.6.11). seroval is transitive and pinned by its parent -- asciinema-player 3.17.0 -> solid-js 1.9.16 -> seroval -- so it moves as a `pnpm.overrides` floor, the same way zod and fast-uri did in #2773. Floored to `>=1.6.11 <1.7.0`, which resolves 1.6.12. Both advisories clear at 1.6.11, and holding the upper bound at the current minor keeps this a patch move on a serializer that solid-js uses for SSR hydration; 1.7.3 exists and satisfies solid-js's `^1.0` range, but nothing about clearing these advisories justifies a minor bump there. Matches the existing `sharp` floor's shape. The lockfile delta is the seroval entry and the three references to it, and nothing else; `pnpm install --lockfile-only` moved no other package, so there is no opportunistic re-resolution to carry. No suppression added, so deny.toml and the threat model's suppressed-advisory list are untouched. npm-only, so no supply-chain audit applies. No behaviour change in bashkit or on the site. Verified: the site advisory scan goes from the two findings above to "no known vulnerabilities found", and the other four pnpm lockfiles and the uv lockfile are clean. CI's own Audit job passes. The site builds on seroval 1.6.12 -- 45 pages, all eleven postbuild verifications pass -- on Node 22.23.4, the version js.yml pins, and the Workers preview deploys. 185/185 script tests, doc links, OKF, capability parity, changelog and workflow parity all pass. No Cargo.lock changed. All 28 checks green.

chaliy merged commit 9fa12b9 into main Oct 24, 2026
50 checks passed

chaliy deleted the eve/clever-mccarthy-ibfdwj branch October 24, 2026 10:15

chaliy mentioned this pull request Oct 29, 2026

fix(deps): clear the seroval script-injection advisories in the site lockfile #2795

Merged

2 tasks done

Navigation Menu

Repository navigation

fix(deps): clear the 2026-10-23 constant-time and npm advisories - #2773

fix(deps): clear the 2026-10-23 constant-time and npm advisories#2773
chaliy merged 1 commit into
mainfrom
eve/clever-mccarthy-ibfdwj

chaliy commented Oct 24, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 24, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

chaliy commented Oct 24, 2026

What changed

Why

cargo-vet

Before / After

Risk

Checklist

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 24, 2026

Deploying with Cloudflare Workers

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant