diff --git a/Cargo.lock b/Cargo.lock index 33f8b6f68..56a1ae9ff 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1416,9 +1416,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" [[package]] name = "crypto-bigint" -version = "0.7.5" +version = "0.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271" +checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0" dependencies = [ "cpubits", "ctutils", @@ -1489,9 +1489,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", "subtle", @@ -5666,7 +5666,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2", diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock index 0bf111d1b..ea23b035d 100644 --- a/crates/bashkit/fuzz/Cargo.lock +++ b/crates/bashkit/fuzz/Cargo.lock @@ -610,9 +610,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", ] diff --git a/examples/hyperlight/Cargo.lock b/examples/hyperlight/Cargo.lock index 943487c13..e4e41f948 100644 --- a/examples/hyperlight/Cargo.lock +++ b/examples/hyperlight/Cargo.lock @@ -323,9 +323,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", ] diff --git a/site/package.json b/site/package.json index 6ea918184..a6d67e4a7 100644 --- a/site/package.json +++ b/site/package.json @@ -39,7 +39,7 @@ "pnpm": { "overrides": { "esbuild": ">=0.28.1", - "fast-uri": "^3.1.8", + "fast-uri": "^3.1.9", "http-cache-semantics": ">=4.3.0", "js-yaml": "^4.3.1", "nanoid": "^3.3.17", @@ -49,7 +49,8 @@ "svgo": "^4.0.2", "undici": "^7.29.0", "ws": ">=8.21.0", - "yaml": ">=2.8.3" + "yaml": ">=2.8.3", + "zod": "^4.6.6" }, "onlyBuiltDependencies": [ "esbuild", diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index 02b28b985..47e86c36a 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: esbuild: '>=0.28.1' - fast-uri: ^3.1.8 + fast-uri: ^3.1.9 http-cache-semantics: '>=4.3.0' js-yaml: ^4.3.1 nanoid: ^3.3.17 @@ -17,6 +17,7 @@ overrides: undici: ^7.29.0 ws: '>=8.21.0' yaml: '>=2.8.3' + zod: ^4.6.6 importers: @@ -1319,8 +1320,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.8: - resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2430,9 +2431,6 @@ packages: youch@4.1.0-beta.10: resolution: {integrity: sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==} - zod@4.5.4: - resolution: {integrity: sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==} - zod@4.6.7: resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} @@ -2582,7 +2580,7 @@ snapshots: '@astrojs/sitemap@3.7.4': dependencies: sitemap: 9.0.1 - zod: 4.5.4 + zod: 4.6.7 '@astrojs/telemetry@3.4.0': dependencies: @@ -3278,7 +3276,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.8 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -3630,7 +3628,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.8: {} + fast-uri@3.1.9: {} fast-wrap-ansi@0.2.2: dependencies: @@ -5164,8 +5162,6 @@ snapshots: cookie: 1.1.1 youch-core: 0.3.3 - zod@4.5.4: {} - zod@4.6.7: {} zwitch@2.0.4: {} diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 035ade0da..a02b8c1af 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -126,6 +126,12 @@ criteria = "safe-to-deploy" delta = "0.0.7 -> 0.0.13" notes = "Reviewed delta: crate metadata only; generated code behavior is unchanged." +[[audits.ctutils]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.4.2 -> 0.4.5" +notes = 'Reviewed complete runtime delta (the RUSTSEC-2026-0385 fix). Two constant-time repairs: every `Choice::to_*_mask` now negates `to_u8()` rather than reading the inner byte directly, so the `black_box` barrier is no longer bypassed on the mask path; and `from_u128_lt`/`from_u128_le` switch to half-width `u64` predicates on 32-bit targets, where full-width subtraction let LLVM lower the comparison to a short-circuiting multiword branch. The comparison macros move verbatim into a new public `primitives` module, which adds a `bitborrow` helper and `black_box` barriers behind `cfg(all(target_arch = "arm", not(target_has_atomic = "ptr")))` (Thumb-1); `CtGt for u128` is hand-written over `from_u128_lt` instead of the macro. The rest is MSRV follow-through for 1.87: `cast_signed`/`cast_unsigned` replacing `as` casts, `to_bool`/`to_u8` becoming `const fn`, and `to_bool_vartime`/`to_u8_vartime` deprecated and redirected to them. `#![forbid(unsafe_code)]` holds, no new dependencies (the `subtle` floor moves 2 -> 2.6), no filesystem, network or process access, and MSRV 1.85 -> 1.87 stays below the pinned toolchain.' + [[audits.der]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 94c7631a0..5d5e3a6f9 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -441,7 +441,7 @@ version = "0.2.4" criteria = "safe-to-run" [[exemptions.crypto-bigint]] -version = "0.7.5" +version = "0.7.6" criteria = "safe-to-deploy" [[exemptions.crypto-common]]