From ce541967f125022cf094c88c163e8b424da9dd19 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sat, 24 Oct 2026 09:19:34 +0000 Subject: [PATCH] fix(deps): clear the 2026-10-23 constant-time and npm advisories Nightly run 276 went red on `Advisory Audit` and main would have followed on its next push: the scan reads every lockfile in the tree regardless of the diff, and three advisory sets landed against code that has not changed. - RUSTSEC-2026-0385, ctutils 0.4.2 -> 0.4.5. Non-constant-time mask generation and `u128` comparisons. Present in `Cargo.lock`, `crates/bashkit/fuzz/Cargo.lock` and `examples/hyperlight/Cargo.lock`, which resolve it independently. - RUSTSEC-2026-0387, crypto-bigint 0.7.5 -> 0.7.6. Multiple timing variability issues in operations intended to be constant-time. Root lockfile only. 0.7.6 requires ctutils >= 0.4.5, so the two bumps have to move together. - site npm: zod < 4.6.6 (GHSA-mrhx-c7xc-m3w5, high: memory exhaustion validating oversized constrained collections) and fast-uri < 3.1.9 (four advisories: scheme injection, scheme spoofing, host confusion, path equivalence). Both Rust crates reach bashkit only through the opt-in `ssh` feature, as russh -> rsa / ssh-key / elliptic-curve, and neither is reachable from a default build. The npm pair is site build tooling and ships in no published artifact. The npm fixes are overrides because the vulnerable versions are transitive and pinned by their parents: `@astrojs/sitemap` 3.7.4 holds zod at 4.5.4 while astro itself already resolves 4.6.7, so the override also dedupes the two copies to one. `fast-uri` was already overridden at a `^3.1.8` floor; that floor moves to `^3.1.9`. cargo-vet: - ctutils gains a reviewed delta audit. The fix is small and readable: every `Choice::to_*_mask` now negates `to_u8()` instead of the inner byte, so the `black_box` barrier stops being bypassed on the mask path, and the `u128` comparisons use half-width `u64` predicates on 32-bit targets. The rest is MSRV-1.87 follow-through. `#![forbid(unsafe_code)]` holds and no dependency is added. - crypto-bigint moves its exemption 0.7.5 -> 0.7.6 rather than claiming a delta review. The delta is 3116 lines across ~60 source files -- four Security entries and eight Fixed entries, a constant-time sweep across limb, Montgomery, gcd and sqrt paths. Writing a delta audit here would claim a review that diff does not get. The crate was exempted, not audited, so the exemption moves, as it did for the rustyline major bump in #2765. `unsafe` occurrences are unchanged at 32 and no runtime dependency is added (num-bigint and num-modular are dev-only); MSRV 1.85 -> 1.87 and resolver 2 -> 3 both stay inside the pinned 1.95 toolchain. No suppression is added, so `deny.toml` and the threat model's suppressed- advisory list are untouched. No behaviour change in bashkit or on the site. Verified: `scripts/audit-lockfiles.sh` exits 0 over all ten lockfiles (cargo-audit 0.22.2 -- 0.21.x cannot parse the CVSS 4.0 advisories now in the database), `cargo vet --locked` succeeds, and the site builds with zod 4.6.7 and fast-uri 3.1.9 with all eleven postbuild verifications passing. Claude-Session: https://claude.ai/code/session_01HdvvSy3syHMpdcpW5Ushhd --- Cargo.lock | 10 +++++----- crates/bashkit/fuzz/Cargo.lock | 4 ++-- examples/hyperlight/Cargo.lock | 4 ++-- site/package.json | 5 +++-- site/pnpm-lock.yaml | 18 +++++++----------- supply-chain/audits.toml | 6 ++++++ supply-chain/config.toml | 2 +- 7 files changed, 26 insertions(+), 23 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 33f8b6f68..56a1ae9ff 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1416,9 +1416,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" [[package]] name = "crypto-bigint" -version = "0.7.5" +version = "0.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271" +checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0" dependencies = [ "cpubits", "ctutils", @@ -1489,9 +1489,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", "subtle", @@ -5666,7 +5666,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2", diff --git a/crates/bashkit/fuzz/Cargo.lock b/crates/bashkit/fuzz/Cargo.lock index 0bf111d1b..ea23b035d 100644 --- a/crates/bashkit/fuzz/Cargo.lock +++ b/crates/bashkit/fuzz/Cargo.lock @@ -610,9 +610,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", ] diff --git a/examples/hyperlight/Cargo.lock b/examples/hyperlight/Cargo.lock index 943487c13..e4e41f948 100644 --- a/examples/hyperlight/Cargo.lock +++ b/examples/hyperlight/Cargo.lock @@ -323,9 +323,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", ] diff --git a/site/package.json b/site/package.json index 6ea918184..a6d67e4a7 100644 --- a/site/package.json +++ b/site/package.json @@ -39,7 +39,7 @@ "pnpm": { "overrides": { "esbuild": ">=0.28.1", - "fast-uri": "^3.1.8", + "fast-uri": "^3.1.9", "http-cache-semantics": ">=4.3.0", "js-yaml": "^4.3.1", "nanoid": "^3.3.17", @@ -49,7 +49,8 @@ "svgo": "^4.0.2", "undici": "^7.29.0", "ws": ">=8.21.0", - "yaml": ">=2.8.3" + "yaml": ">=2.8.3", + "zod": "^4.6.6" }, "onlyBuiltDependencies": [ "esbuild", diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index 02b28b985..47e86c36a 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: esbuild: '>=0.28.1' - fast-uri: ^3.1.8 + fast-uri: ^3.1.9 http-cache-semantics: '>=4.3.0' js-yaml: ^4.3.1 nanoid: ^3.3.17 @@ -17,6 +17,7 @@ overrides: undici: ^7.29.0 ws: '>=8.21.0' yaml: '>=2.8.3' + zod: ^4.6.6 importers: @@ -1319,8 +1320,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.8: - resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2430,9 +2431,6 @@ packages: youch@4.1.0-beta.10: resolution: {integrity: sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==} - zod@4.5.4: - resolution: {integrity: sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==} - zod@4.6.7: resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} @@ -2582,7 +2580,7 @@ snapshots: '@astrojs/sitemap@3.7.4': dependencies: sitemap: 9.0.1 - zod: 4.5.4 + zod: 4.6.7 '@astrojs/telemetry@3.4.0': dependencies: @@ -3278,7 +3276,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.8 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -3630,7 +3628,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.8: {} + fast-uri@3.1.9: {} fast-wrap-ansi@0.2.2: dependencies: @@ -5164,8 +5162,6 @@ snapshots: cookie: 1.1.1 youch-core: 0.3.3 - zod@4.5.4: {} - zod@4.6.7: {} zwitch@2.0.4: {} diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 035ade0da..a02b8c1af 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -126,6 +126,12 @@ criteria = "safe-to-deploy" delta = "0.0.7 -> 0.0.13" notes = "Reviewed delta: crate metadata only; generated code behavior is unchanged." +[[audits.ctutils]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.4.2 -> 0.4.5" +notes = 'Reviewed complete runtime delta (the RUSTSEC-2026-0385 fix). Two constant-time repairs: every `Choice::to_*_mask` now negates `to_u8()` rather than reading the inner byte directly, so the `black_box` barrier is no longer bypassed on the mask path; and `from_u128_lt`/`from_u128_le` switch to half-width `u64` predicates on 32-bit targets, where full-width subtraction let LLVM lower the comparison to a short-circuiting multiword branch. The comparison macros move verbatim into a new public `primitives` module, which adds a `bitborrow` helper and `black_box` barriers behind `cfg(all(target_arch = "arm", not(target_has_atomic = "ptr")))` (Thumb-1); `CtGt for u128` is hand-written over `from_u128_lt` instead of the macro. The rest is MSRV follow-through for 1.87: `cast_signed`/`cast_unsigned` replacing `as` casts, `to_bool`/`to_u8` becoming `const fn`, and `to_bool_vartime`/`to_u8_vartime` deprecated and redirected to them. `#![forbid(unsafe_code)]` holds, no new dependencies (the `subtle` floor moves 2 -> 2.6), no filesystem, network or process access, and MSRV 1.85 -> 1.87 stays below the pinned toolchain.' + [[audits.der]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 94c7631a0..5d5e3a6f9 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -441,7 +441,7 @@ version = "0.2.4" criteria = "safe-to-run" [[exemptions.crypto-bigint]] -version = "0.7.5" +version = "0.7.6" criteria = "safe-to-deploy" [[exemptions.crypto-common]]