fix(deps): update tokio and crypto-bigint security patches

Cargo.toml

@@ -16,7 +16,7 @@ repository = "https://github.com/NVIDIA/OpenShell"
 # Product backend selection. Consumer crates inherit this choice.
 openshell-crypto = { path = "crates/openshell-crypto", default-features = false, features = ["aws-lc"] }
 # Async runtime
-tokio = { version = "1.43", features = ["full"] }
+tokio = { version = "1.53.3", features = ["full"] }
 
 # gRPC/Protobuf
 tonic = "0.14"

crates/openshell-sandbox-backend/src/lib.rs

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-#![forbid(unsafe_code)]
+#![deny(unsafe_code)]
 
 //! Concrete supervisor-side client for the Isolation Backend and Sandbox Protocol RPCs.
 //!

crates/openshell-sandbox-backend/src/runtime_initiated.rs

@@ -255,8 +255,12 @@ impl Listener {
         socket.set_nonblocking(true)?;
         socket.bind(&socket2::SockAddr::vsock(libc::VMADDR_CID_ANY, port))?;
         socket.listen(64)?;
+        // SAFETY: `socket` owns a valid descriptor and is moved into AsyncFd.
+        // The descriptor is never closed or replaced while registered.
+        #[allow(unsafe_code)]
+        let listener = unsafe { tokio::io::unix::AsyncFd::register(socket)? };
         Ok(Self::Vsock {
-            listener: tokio::io::unix::AsyncFd::new(socket)?,
+            listener,
             guest_cid,
         })
     }

crates/openshell-sandbox/src/main_session.rs

@@ -560,7 +560,12 @@ impl MainSession {
     ) {
         match io {
             ProcessIo::Pty(master) => {
-                let master = Arc::new(AsyncFd::new(master).expect("register canonical PTY master"));
+                // SAFETY: `master` owns a valid PTY descriptor and is moved into AsyncFd.
+                // The descriptor is never closed or replaced while registered.
+                #[allow(unsafe_code)]
+                let master =
+                    unsafe { AsyncFd::register(master) }.expect("register canonical PTY master");
+                let master = Arc::new(master);
                 let reader = Arc::clone(&master);
                 let output = Arc::clone(this);
                 tokio::spawn(async move {

crates/openshell-server/src/grpc/sandbox.rs

@@ -9378,7 +9378,8 @@ mod tests {
                 update_sandbox_cas(&state, &sandbox_id, 0, |sandbox| {
                     if first_attempt {
                         first_attempt = false;
-                        barrier.wait();
+                        // Hand off queued work so SQLx can return the connection to other writers.
+                        tokio::task::block_in_place(|| barrier.wait());
                     }
                     let annotations = &mut sandbox.metadata.as_mut().unwrap().annotations;
                     let count = annotations

deny.toml

@@ -21,6 +21,10 @@ ignore = [
     { id = "RUSTSEC-2026-0204", reason = "crossbeam-epoch pointer deref — transitive via metrics/quanta" },
     { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via spiffe, no direct exposure" },
     { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — transitive via older kube/hyper" },
+    # SPIFFE's jsonwebtoken RustCrypto stack still requires crypto-bigint 0.5.
+    # Remove after compatible upstream releases include the dependency upgrade:
+    # https://github.com/Keats/jsonwebtoken/pull/536
+    { id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.5 timing variability — transitive via SPIFFE/jsonwebtoken; remove when the dependency chain supports crypto-bigint >=0.7.6" },
     # zip is used only by z3-sys's build script with prebuilt-z3 enabled to
     # extract upstream Z3 GitHub release assets, never runtime/user archives.
     # Accept the build-time risk of a compromised upstream release asset until