Skip to content

fix(deps): clear the 2026-10-23 constant-time and npm advisories #2773

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chaliy merged 1 commit into from
Oct 24, 2026
Merged

fix(deps): clear the 2026-10-23 constant-time and npm advisories #2773

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions crates/bashkit/fuzz/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions examples/hyperlight/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions site/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
"pnpm": {
"overrides": {
"esbuild": ">=0.28.1",
"fast-uri": "^3.1.8",
"fast-uri": "^3.1.9",
"http-cache-semantics": ">=4.3.0",
"js-yaml": "^4.3.1",
"nanoid": "^3.3.17",
Expand All @@ -49,7 +49,8 @@
"svgo": "^4.0.2",
"undici": "^7.29.0",
"ws": ">=8.21.0",
"yaml": ">=2.8.3"
"yaml": ">=2.8.3",
"zod": "^4.6.6"
},
"onlyBuiltDependencies": [
"esbuild",
Expand Down
18 changes: 7 additions & 11 deletions site/pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions supply-chain/audits.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,12 @@ criteria = "safe-to-deploy"
delta = "0.0.7 -> 0.0.13"
notes = "Reviewed delta: crate metadata only; generated code behavior is unchanged."

[[audits.ctutils]]
who = "Mykhailo Chalyi <mike@chaliy.name>"
criteria = "safe-to-deploy"
delta = "0.4.2 -> 0.4.5"
notes = 'Reviewed complete runtime delta (the RUSTSEC-2026-0385 fix). Two constant-time repairs: every `Choice::to_*_mask` now negates `to_u8()` rather than reading the inner byte directly, so the `black_box` barrier is no longer bypassed on the mask path; and `from_u128_lt`/`from_u128_le` switch to half-width `u64` predicates on 32-bit targets, where full-width subtraction let LLVM lower the comparison to a short-circuiting multiword branch. The comparison macros move verbatim into a new public `primitives` module, which adds a `bitborrow` helper and `black_box` barriers behind `cfg(all(target_arch = "arm", not(target_has_atomic = "ptr")))` (Thumb-1); `CtGt for u128` is hand-written over `from_u128_lt` instead of the macro. The rest is MSRV follow-through for 1.87: `cast_signed`/`cast_unsigned` replacing `as` casts, `to_bool`/`to_u8` becoming `const fn`, and `to_bool_vartime`/`to_u8_vartime` deprecated and redirected to them. `#![forbid(unsafe_code)]` holds, no new dependencies (the `subtle` floor moves 2 -> 2.6), no filesystem, network or process access, and MSRV 1.85 -> 1.87 stays below the pinned toolchain.'

[[audits.der]]
who = "Mykhailo Chalyi <mike@chaliy.name>"
criteria = "safe-to-deploy"
Expand Down
2 changes: 1 addition & 1 deletion supply-chain/config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -441,7 +441,7 @@ version = "0.2.4"
criteria = "safe-to-run"

[[exemptions.crypto-bigint]]
version = "0.7.5"
version = "0.7.6"
criteria = "safe-to-deploy"

[[exemptions.crypto-common]]
Expand Down
Loading