Repository navigation
fix(deps): update ctutils to resolve timing advisory - #4867
Merged
Merged
Conversation
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
|
Label |
SDAChess
enabled auto-merge
October 23, 2026 13:43
alangou
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update
ctutilsto 0.4.4 to resolve the published RUSTSEC-2026-0385 advisory reported by the release qualification job. The root dependency advisory check now passes.Related Issue
No issue, as requested.
Changes
ctutilsversion and checksum in the root lockfile and six affected example/test lockfiles.Release Notes
Testing
cargo deny --locked check advisoriespasses with a refreshed advisory database.cargo test --locked --offline -p openshell-supervisor-process --lib: 128 passed.cargo check --locked --offline -p openshell-serverpasses.cargo clippy --locked --offline -p openshell-supervisor-process --lib -- -D warningspasses.cargo fmt --all --checkandgit diff --checkpass.Rust checks ran in a temporary copy of the tracked checkout using the cached Nix development environment because an unrelated leftover directory without a manifest prevents Cargo workspace discovery in the original checkout. All seven lockfiles match the verified copies.
Additional advisory checks pass for the V8 example. Five secondary example/test workspaces still report unrelated, pre-existing advisories; this change leaves those dependencies untouched. No application code or tests changed.
The local pre-commit hook was bypassed with explicit approval after it failed while setting up missing tooling. The focused checks above passed.
Checklist