From 9cd7a86723f0e3f775314b1d9a430e79ce68318e Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Tue, 27 Oct 2026 01:12:24 +0100
Subject: [PATCH 1/2] ci: pin the hosted test lane to ubuntu-24.04 so the
 Python bindings link again

GitHub moved ubuntu-latest to Ubuntu 26.04. The ts_python pyo3 cdylib links
libpython3.12, which 26.04 does not ship, and the target/ cache restored a
build config from 24.04, so the required check failed with
'unable to find library -lpython3.12' on every PR.

Signed-off-by: GeiserX <9169332+GeiserX@users.noreply.github.com>
---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed67532..8148593 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,7 +61,10 @@ jobs:
     # Self-hosted Linux/X64 runner (Docker container on the maintainer's infra) — keeps CI off paid
     # GitHub-hosted minutes. The inherited `build_test`/`arch_independent` matrices target other
     # self-hosted labels (`linux-x86_64-16cpu`, …) that don't exist here and stay owner-gated.
-    runs-on: ubuntu-latest
+    # Pinned to 24.04, not `ubuntu-latest`: the ts_python pyo3 cdylib links libpython3.12, which
+    # 24.04 ships and 26.04 (the `ubuntu-latest` image since late October 2026) does not. The
+    # target/ cache key carries no image name, so a moved image also restores a 3.12 build config.
+    runs-on: ubuntu-24.04
     # Skip on tag pushes: this lane verifies code, and `publish` (which fires on tags) deliberately
     # does NOT depend on it, so re-running the full build+test on every release tag gates nothing.
     # SECURITY: this runs on a self-hosted runner with Docker-socket access. Never let a PR from a

From cccab50b882b89f47f47e8289ed7716c6a726389 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Tue, 27 Oct 2026 01:32:00 +0100
Subject: [PATCH 2/2] fix(deps): move ctutils to 0.4.6 to close
 RUSTSEC-2026-0385

ctutils 0.4.2 (via digest -> blake2 -> argon2 -> ts_tka) can branch on secret
values in its constant-time mask generation and u128 comparisons. cargo deny
now fails the required hosted test on it. The cargo vet exemption moves with
the version.

Signed-off-by: GeiserX <9169332+GeiserX@users.noreply.github.com>
---
 Cargo.lock               | 4 ++--
 supply-chain/config.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ec07565..62f7d0d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1092,9 +1092,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "fe3e9d21d39e6f39ff46e03d5b621424f88ee23d8a1672c6bfc9ccc7f2da4f6a"
 dependencies = [
  "cmov",
  "subtle",
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index 35a9cfd..675f52f 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -526,7 +526,7 @@ version = "0.10.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.ctutils]]
-version = "0.4.2"
+version = "0.4.6"
 criteria = "safe-to-deploy"
 
 [[exemptions.curve25519-dalek]]