[chaliy]

What changed

Complete the remaining standalone dependency checks: Hyperlight now locks patched Tokio 1.53.3, and its guest/host smoke builds use --locked. All Cargo lockfile scans fail on informational unsound findings, with a regression showing that other ecosystems are still scanned after a failure.

Replace yanked Windows-only clipboard-win 5.4.1 with reviewed 5.4.3 and record its precise cargo-vet delta. Retire only the withdrawn braces advisory suppression. Document patched Node host versions versus legacy ABI compatibility.

Why

Main's audit printed RUSTSEC-2026-0386 for Hyperlight but returned success, leaving a green gate with an unsound dependency. The separate workspace needed its own lock update. Node build/runtime pins already landed through #2772.

Before / After

• Hyperlight: Tokio 1.53.1 -> 1.53.3, matching patched root/fuzz. Unix AsyncFd is not compiled into the wasm guest; this corrects the locked graph and future audit enforcement, not a demonstrated guest exploit.
• Real cargo-audit reproduction against the old lock: default exit 0 with an unsound warning; --deny unsound exit 1. All four final Cargo locks have zero vulnerability/unsound findings.
• Windows CLI dependency: clipboard-win 5.4.1 was yanked. The 5.4.3 source delta replaces unchecked HTML copying/set_len with checked slicing/extend and bounded retry sleep. Rustyline uses Unicode clipboard reads; reachability of the changed HTML API through Bashkit is not established. Dependency/features/license are unchanged; no new exemptions or publisher trust were added.
• GHSA-vfj7-8cjw-p6xm was withdrawn on 2026-10-23 as not practically exploitable. The npm exception list is now empty. Braces 3.0.3 remains development-only through AVA; no patched-code claim is made.

Validation

• Pinned Rust 1.95 just pre-pr passed: formatting, Clippy, full default tests, 180 repository-script tests, knowledge/docs/workflow parity, changelog and cargo-vet. Final Windows dependency delta also passes cargo vet --locked (98 fully audited, 86 partially audited, 492 existing exemptions).
• Hyperlight locked release guest -> component -> native ARM64 Wasmtime host smoke passed: expected pipeline/jq/sleep output and only host-world imports. Real micro-VM boot is not tested (requires KVM/WHP hardware).
• cargo deny --locked --all-features check passed advisories, bans, licenses and sources.
• Fresh RustSec DB 21d909e4c8bd4e14c7aea58bf980c881a0053ab1: all four locks pass; final root yanked-version scan leaves only the existing atomic-polyfill unmaintained notice.
• New audit regression failed before the script fix and passed afterward; no exceptions/gates weakened.
• Patched Node 22.23.4 and 24.22.1 runtime/Brotli round-trip smoke passed.
• Additional slices passed: 7,130 HTTP/SSH/SQLite test results; 186 rustdoc tests; 19 single-threaded failpoint tests; 29 security property tests; locked fuzz compile. The default pre-pr counted 7,259 successful results across 34 groups. Counts overlap across configurations; ignored tests remain explicitly reported by their harnesses.
• All 50 exact-head checks SUCCESS at da55095c9740599721590ec2227878a576fae25a, including required Check, Python/JS/platform matrices, Rust CodeQL and the real ecosystem Audit. Previously denied local npm/OSV operations were not retried.

Risk

Low/medium: lockfile and audit enforcement changes. Windows behavior requires green hosted checks. RSA Marvin remains explicitly accepted only for opt-in SSH; latest published RSA prerelease still warns of exposure and russh pins rc.18. This change neither removes RSA compatibility nor claims exploitation was demonstrated. Node 18/20 ABI compatibility is not security support. No package releases or tags are requested.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	da55095	Commit Preview URL Branch Preview URL	Oct 24 2026, 10:30 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!