[SDAChess]

Summary

Update Tokio to 1.53.3 and migrate owned PTY and VSOCK descriptors to its explicit unsafe registration API for RUSTSEC-2026-0386. Update the workspace's crypto-bigint 0.7.5 to 0.7.10, including ctutils 0.4.6, for RUSTSEC-2026-0387.

Temporarily acknowledge the remaining crypto-bigint 0.5.5 finding in deny.toml while its upstream dependency chain is updated. SPIFFE and crypto backend feature selection remain unchanged.

Related Issue

No separate issue. This addresses the reported dependency-audit failures for Tokio and crypto-bigint 0.7.5.

Changes

• Resolve Tokio to 1.53.3 in the workspace, examples, E2E, testkit, test suites, and test-machine lockfiles that contained affected versions.
• Raise the workspace Tokio minimum to 1.53.3 for the required AsyncFd::register API.
• Replace both AsyncFd::new calls with unsafe registration, documenting owned-descriptor lifetime guarantees and allowing unsafe code only on the registration statements. Change the sandbox backend's crate-level lint from forbid(unsafe_code) to deny(unsafe_code) to permit its local exception.
• Resolve crypto-bigint 0.7.5 to 0.7.10 and its required ctutils update from 0.4.4 to 0.4.6.
• Add a documented temporary exception for RUSTSEC-2026-0387, with an upstream link and removal condition.
• Wrap the concurrent CAS test's synchronous barrier in tokio::task::block_in_place so SQLx can return the fixture's single connection while writers synchronize.

The remaining dependency chain is spiffe -> jsonwebtoken -> p256/p384 -> elliptic-curve -> crypto-bigint 0.5.5. The elliptic-curve 0.13 stack requires crypto-bigint 0.5, so a lockfile update cannot move this chain to a patched version. Keats/jsonwebtoken#536 upgrades the coordinated RustCrypto stack, including p256/p384 to 0.14. Remove the exception once compatible upstream releases let us resolve the remaining chain to crypto-bigint >=0.7.6.

The exception acknowledges timing-side-channel risk; this PR does not establish application-level exploitability. cargo-deny 0.20.2 ignores advisory IDs globally, so this exception cannot be restricted to version 0.5.5 in configuration. The separate crypto-bigint 0.7 dependency is still upgraded to 0.7.10.

Release Notes

Testing

• cargo clippy --workspace --all-targets --locked --offline -- -D warnings passes.
• cargo test --locked --offline -p openshell-sandbox --lib main_session::tests passes: 24 tests, including PTY input/output.
• cargo test --locked --offline -p openshell-sandbox-backend --lib passes: 80 tests. Tests run outside the restricted sandbox so loopback and Unix-socket fixtures can operate.
• CARGO_NET_OFFLINE=true tasks/scripts/check-cargo-lockfiles.sh validates all tracked lockfiles.
• cargo fmt --all -- --check and git diff --check pass.
• cargo test --locked --offline -p openshell-server --features test-support --lib grpc::sandbox::tests::server_managed_sandbox_cas_retries_concurrent_updates -- --exact passes. The compiled test also passed 25 consecutive standalone runs, each bounded by an external 10-second timeout.
• All 13 persistence::tests::cas_ tests pass.
• cargo clippy --locked --offline -p openshell-server --features test-support --all-targets -- -D warnings passes.
• Full workspace CI validation of the updated commit is pending.
• cargo deny --locked --offline check --hide-inclusion-graph passes all four checks with the temporary exception. Before adding the exception, the only remaining error was RUSTSEC-2026-0387 for crypto-bigint 0.5.5.
• The local pre-commit hook was skipped with explicit approval after its broad mise task failed while installing missing Node/Python tooling. The scoped checks above were run separately.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Architecture documentation is not affected. Existing PTY and backend test suites were run; no new tests were added. VSOCK registration was compile-checked; no VSOCK device test was run locally.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.