Repository navigation
fix(deps): bump ctutils to 0.4.5 - #14887
Merged
Merged
Conversation
Resolves the cargo deny advisory for non-constant-time mask generation and u128 comparisons in ctutils 0.4.3. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Entire-Checkpoint: 01M5M4JEMDDTGFBFADN8XW4K4H
Contributor
|
No reviewable files after applying ignore patterns. |
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jdx
enabled auto-merge (squash)
October 23, 2026 10:27
mise-en-dev
added a commit
that referenced
this pull request
Oct 24, 2026
<!-- entire-trail-link-start --> https://entire.com/gh/jdx/-/trails/2718/changes/mise/998 <!-- entire-trail-link-end --> ### 🚀 Features - **(config)** expose mise_config_dir to templates by @jdx in [#14886](#14886) - **(lsp)** send semantic tokens for tasks, tools, env vars and templates by @jdx in [#14918](#14918) ### 🐛 Bug Fixes - **(lock)** rebuild lockfiles completely by default by @jdx in [#14893](#14893) - **(pipx)** list git+ssh github.com sources over ssh when GitHub can't see them by @jdx in [#14905](#14905) - **(python)** stop uv_venv_auto from fork-bombing through python shims by @jdx in [#14927](#14927) - **(task)** apply extended template usage to file tasks by @jdx in [#14888](#14888) - **(task)** quote and escape header values written by tasks add --file by @xucian in [#14925](#14925) - **(uninstall)** remove installs whose directories deny their owner writes by @HengYangDS in [#14883](#14883) - **(upgrade)** don't downgrade date-versioned tools with leading zeros by @jdx in [#14923](#14923) ### 📚 Documentation - tell agents not to edit the vendored aqua registry by @jdx in [#14910](#14910) ### 🧪 Testing - update e2e expectations after version validation moved earlier by @jdx in [#14920](#14920) - pin java relock e2e to a fully published Temurin line by @jdx in [#14940](#14940) ### 📦️ Dependency Updates - bump ctutils to 0.4.5 by @jdx in [#14887](#14887) - update aube to v2.8.2 by @renovate[bot] in [#14889](#14889) - update rust crate clx to v3.0.5 by @renovate[bot] in [#14890](#14890) - ignore RUSTSEC-2026-0387 in cargo-deny by @jdx in [#14939](#14939) ### Ci - retry snapcraft upload on transient store errors by @jdx in [#14909](#14909) ### Security - **(backend)** keep untrusted values out of subprocess arguments and the project directory by @jdx in [#14896](#14896) - **(backend)** keep archive contents and release asset names inside the install directory by @jdx in [#14895](#14895) - **(backend)** validate versions and names that become paths or URL segments by @jdx in [#14901](#14901) - **(backend)** tighten SLSA signer and GitHub attestation checks by @jdx in [#14904](#14904) - **(backend)** make SLSA, attestation and signed-checksum checks fail closed by @jdx in [#14908](#14908) - **(backend)** reject SLSA provenance built from another tag by @jdx in [#14924](#14924) - **(completion)** stop shell completion from running untrusted task code by @jdx in [#14898](#14898) - **(config)** tie trust to the right files for worktrees, symlinks and config dirs by @jdx in [#14902](#14902) - **(config)** close safe-mode gaps for lazy tools, deps, S3, bin_path and templates by @jdx in [#14900](#14900) - **(config)** stop treating help, shims, hooks and config writes as consent to trust by @jdx in [#14903](#14903) - **(config)** keep untrusted repo content from hanging or crashing hook-env by @jdx in [#14916](#14916) - **(github)** send forge tokens only to their API host and harden release caches by @jdx in [#14913](#14913) - **(hooks)** render hook commands once and keep templates out of written versions by @jdx in [#14897](#14897) - **(http)** bound response, download and archive sizes and slow response bodies by @jdx in [#14915](#14915) - **(install)** enforce pinned checksums and node signatures instead of falling back by @jdx in [#14899](#14899) - **(lockfile)** stop lockfiles, tool stubs and the task cache from reaching outside the repo by @jdx in [#14906](#14906) - **(packslip)** pin signers by repository ID and stop release-age backdating by @jdx in [#14912](#14912) - **(task)** close sandbox escapes in --allow-write, --deny-net and --deny-write, and OCI whiteouts by @jdx in [#14911](#14911) - keep credentials out of install paths, lockfiles, logs and redirects by @jdx in [#14917](#14917) ### New Contributors - @xucian made their first contribution in [#14925](#14925) - @HengYangDS made their first contribution in [#14883](#14883) ## 📦 Aqua Registry Updates ### New Packages (5) - [`Future-Element/pinset`](https://github.com/Future-Element/pinset) - [`bronto-community/bronto-cli`](https://github.com/bronto-community/bronto-cli) - [`faberlang/releases/faber`](https://github.com/faberlang/releases) - [`muvon/octomind`](https://github.com/muvon/octomind) - [`pratyay360/ensor`](https://github.com/pratyay360/ensor) ### Updated Packages (5) - [`anomalyco/opencode`](https://github.com/anomalyco/opencode) - [`duckdb/duckdb`](https://github.com/duckdb/duckdb) - [`grafana/gcx`](https://github.com/grafana/gcx) - [`grafana/mcp-grafana`](https://github.com/grafana/mcp-grafana) - [`magefile/mage`](https://github.com/magefile/mage)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://entire.com/gh/jdx/mise/trails/994
Summary
`cargo deny check` fails in CI on `ctutils 0.4.3` (non-constant-time mask generation and `u128` comparisons). This bumps `ctutils` to 0.4.5 in `Cargo.lock` only; `Cargo.toml` is unchanged. It is a transitive dependency via `digest` → `blake2` → `packslip`.
Test plan
AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.
🤖 Generated with Claude Code