chore: bump ruint 1.18.0 -> 1.20.0 (RUSTSEC-2026-0220) - #165
Merged
Conversation
New advisory: Uint shift operations return incorrect overflow flags and truncate shift amounts; fixed in ruint >=1.20.0. Transitive via alloy. Lockfile-only bump; also pulls in the ark-ff 0.6 crates as new transitive deps of ruint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jacderida
approved these changes
Aug 11, 2026
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear issue
V2-851
Risk tier
Compatibility
Cargo.lock-only patch bump of a transitive dependency (ruint1.18.0 → 1.20.0, via the alloy/evmlib tree). The advisory (RUSTSEC-2026-0220, "Uint shift operations: incorrect overflow flags and truncated shift amounts") concerns EVM uint math, so getting the fixed version in is desirable beyond audit hygiene.Semver impact
Test evidence
cargo auditon main currently fails with exactly one vulnerability — RUSTSEC-2026-0220 (ruint 1.18.0) — which has turned the Security Audit job red on every open PR (fix(core): surface partial external-signer merkle uploads as PartialUpload #167, feat(core): multi-batch external merkle signing + spill-backed prepared uploads #168). This bump clears it (fix version per the advisory is >=1.20.0).New dependency
none (version bump of an existing transitive dependency)
ADR
n/a
Mitigation / rollback
Single-commit revert of the lockfile change.