Skip to content

fix(deps): update ctutils to resolve timing advisory - #4867

Merged
SDAChess merged 1 commit into
mainfrom
fix/update-ctutils/SDAChess
Oct 23, 2026
Merged

SDAChess merged 1 commit into
mainfrom
fix/update-ctutils/SDAChess

Conversation

@SDAChess

Copy link
Copy Markdown
Member

Summary

Update ctutils to 0.4.4 to resolve the published RUSTSEC-2026-0385 advisory reported by the release qualification job. The root dependency advisory check now passes.

Related Issue

No issue, as requested.

Changes

  • Update the ctutils version and checksum in the root lockfile and six affected example/test lockfiles.

Release Notes

Testing

  • Root cargo deny --locked check advisories passes with a refreshed advisory database.
  • cargo test --locked --offline -p openshell-supervisor-process --lib: 128 passed.
  • cargo check --locked --offline -p openshell-server passes.
  • cargo clippy --locked --offline -p openshell-supervisor-process --lib -- -D warnings passes.
  • cargo fmt --all --check and git diff --check pass.

Rust checks ran in a temporary copy of the tracked checkout using the cached Nix development environment because an unrelated leftover directory without a manifest prevents Cargo workspace discovery in the original checkout. All seven lockfiles match the verified copies.

Additional advisory checks pass for the V8 example. Five secondary example/test workspaces still report unrelated, pre-existing advisories; this change leaves those dependencies untouched. No application code or tests changed.

The local pre-commit hook was bypassed with explicit approval after it failed while setting up missing tooling. The focused checks above passed.

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

Signed-off-by: Simon Scatton <sscatton@nvidia.com>
@SDAChess SDAChess added the test:e2e Requires end-to-end coverage label Oct 23, 2026
@github-actions

Copy link
Copy Markdown

Label test:e2e applied for 7093055. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

@SDAChess
SDAChess enabled auto-merge October 23, 2026 13:43
@SDAChess
SDAChess requested a review from alangou October 23, 2026 13:43
@SDAChess
SDAChess disabled auto-merge October 23, 2026 14:12
@SDAChess
SDAChess added this pull request to the merge queue Oct 23, 2026
Merged via the queue into main with commit bc4c8f0 Oct 23, 2026
154 checks passed
@SDAChess
SDAChess deleted the fix/update-ctutils/SDAChess branch October 23, 2026 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants