Bump ctutils past RUSTSEC-2026-0385

Merged
RO
22d ago
+4-4

What

cargo update -p ctutils in rust/Cargo.lock and conformance/runner/rust/Cargo.lock: ctutils 0.4.2 to 0.4.5. Nothing else moves.

Why

RustSec published RUSTSEC-2026-0385 against ctutils below 0.4.4 (non-constant-time mask generation). ctutils reaches the SDK through digest (hmac, sha2). cargo deny now fails on any branch, and the required Conformance Tests check fails with it, because it waits on the Rust job. Found on https://github.com/basecamp/basecamp-sdk/pull/1038, whose own change doesn't touch either lockfile.

Testing

  • make rs-deny: advisories FAILED before, advisories ok, bans ok, licenses ok, sources ok after.
  • make rs-check passes. The Rust conformance runner builds with --locked.

Summary by cubic

Bumps ctutils from 0.4.2 to 0.4.5 in both Rust lockfiles to clear RUSTSEC-2026-0385, which flags non-constant-time mask generation in versions below 0.4.4. cargo deny now passes on every branch, and the Conformance Tests check no longer fails waiting on the Rust job. Nothing else moves in either lockfile.