[loganj]

🤖

Summary

On 2026-10-23, RustSec published RUSTSEC-2026-0385 against ctutils, a constant-time helper crate used by the RustCrypto hashing and HMAC crates. Some of its functions were meant to run in constant time, so their timing would reveal nothing about secret values, but in versions before 0.4.4 they could compile to code that branches on those values. Since the advisory came out, cargo-deny check reports advisories as failed. That breaks Security Domain / Security on main and on every PR that runs the Rust security job.

This PR changes ctutils from 0.4.2 to 0.4.5 in the three lockfiles that pin it: Cargo.lock, desktop/src-tauri/Cargo.lock, and the buzz-feature-flags relay-feature-selection test fixture. No other packages change.

Advisory	Crate	Change
RUSTSEC-2026-0385	ctutils (non-constant-time mask generation and u128 comparisons)	0.4.2 → 0.4.5

Related issue

N/A. I searched open and closed PRs for ctutils and RUSTSEC-2026-0385 and found none.

Testing

• cargo deny check advisories: advisories ok. On origin/main the Security job fails on this advisory.
• cargo check --workspace passes.
• cargo test -p buzz-feature-flags --test relay_feature_selection_contract passes. This test compiles the fixture with --locked.
• The pre-push hook's Rust and Tauri lanes pass.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 016310d3cc44688779a7d517a13d9cc8024ddfa8...e931db2bcd2c22bce8daef68ae6f881608553753
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

The PR only updates ctutils from 0.4.2 to 0.4.5 with matching checksums across all three Cargo lockfiles. No concrete security, correctness, or reliability findings were identified.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Dependency implementation was not included in the checkout. Upstream source and checksum authenticity could not be independently verified without network access. Builds and tests were not run, as instructed.

---

_{Generated by Codex Security Review |
Requested by: @loganj |
Workflow run}

[jedwards27]

Verdict: APPROVE

Reviewed: 016310d3cc44688779a7d517a13d9cc8024ddfa8..e931db2bcd2c22bce8daef68ae6f881608553753 (exact head e931db2bcd2c22bce8daef68ae6f881608553753)

Risk: high by class because this is a Rust security dependency/lockfile change that reaches relay, desktop Tauri, and a fixture lockfile; low implementation complexity because the source and manifests are unchanged.

Behavior/contracts traced: root, desktop Tauri, and feature-flag fixture Cargo.lock consistency; ctutils reverse dependency graph; root cargo-deny advisory gate for RUSTSEC-2026-0385; repo MSRV compatibility; exact-head CI coverage for Rust, desktop, relay/PostgreSQL, security, packaging/build jobs, and DCO.

Findings: none. The diff only updates the ctutils package block from 0.4.2 to 0.4.5 plus checksum in the three repository lockfiles. I found no source, manifest, deny.toml, package-count, stale-lockfile, or direct-reference drift.

Author action: none.

Verification owner: none for the author. CI/reviewer evidence covers this PR’s contract. Separate security-policy hygiene noted during review — pre-existing desktop-only cargo-deny advisories and a pre-existing stale RUSTSEC-2026-0381 ignore warning — is not introduced by this PR and is not a #8560 blocker.

Validation at exact head e931db2bcd2c22bce8daef68ae6f881608553753:

• Reviewed git diff --name-status / lockfile hunks against base and git diff --check; scope is exactly Cargo.lock, desktop/src-tauri/Cargo.lock, and crates/buzz-feature-flags/tests/fixtures/relay-feature-selection/Cargo.lock.
• Verified all three changed lockfiles resolve ctutils v0.4.5; reverse dependency checks show the expected transitive reachability through digest and downstream Rust/desktop consumers.
• Verified root cargo-deny --locked check advisories fails on base for RUSTSEC-2026-0385 and passes at head; full root cargo-deny --locked check passes at head.
• Verified cargo check --locked --workspace passes at head.
• Verified cargo test --locked -p buzz-feature-flags --test relay_feature_selection_contract passes 5/5 at head.
• Re-checked GitHub status rollup immediately before approval: exact head is still e931db2bcd2c22bce8daef68ae6f881608553753, with no failing or pending required checks observed; relevant Rust, Desktop, Relay/PostgreSQL, Security, macOS/Windows desktop build, Docker, Semgrep, zizmor, and DCO checks are green or intentionally skipped.

Manual/native evidence: no manual UI/native app run. This is a lockfile-only dependency bump with no source/manifest/user-visible behavior change; desktop/native build coverage comes from exact-head CI.

Residual risk: standalone desktop-manifest cargo-deny remains noisy from advisories that are red on both base and head, while the repository’s actual security workflow runs root cargo-deny and is green after this PR. I did not treat that pre-existing per-lockfile gap as an author action for #8560.