[kwsantiago]

Summary

• Two new advisories fail cargo deny: RUSTSEC-2026-0385 (ctutils non-constant-time masks) and RUSTSEC-2026-0387 (crypto-bigint timing variability, fixed only in 0.7.6).
• ctutils moves to 0.4.5 in the root, enclave and agent-binding lockfiles.
• keep-core turns off vsss-rs default features, keeping std and zeroize. Its bigint feature was the only thing that built crypto-bigint 0.6.1, which keep never called; the Shamir split and combine run on k256 types either way, and keep serializes shares itself, so the dropped serde and primitive features were unused. 0.6.1 still appears in Cargo.lock through vsss-rs weak features but is not compiled, so lockfile-only scanners may still list it.
• crypto-bigint 0.5.5 stays, pinned through k256 0.13 by frost-secp256k1-tr and voprf, neither of which has a k256 0.14 release. It is ignored by ID with the reasoning in deny.toml. k256 0.13 calls it on secrets only for its mask-based modular add, subtract, negate and comparisons; scalar multiplication, inversion and field arithmetic are k256's own code, and 0.5.5 contains none of the advisory's UintRef, BoxedMontyForm or ctutils code. [bans] entries refuse crypto-bigint 0.6 and 0.7 below 0.7.6, pre-releases included, so the ignore cannot hide a returning unpatched line.

Test plan

• cargo deny check passes for the root workspace and both agent bindings
• cargo tree -i crypto-bigint@0.6.1 is empty (crate not compiled)
• keep-core tests with oprf, keep-frost-net OPRF tests, enclave workspace tests
• cargo clippy --workspace --all-targets with the CI feature set, warnings denied

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1cdbf3fe-a6b4-4e7d-b9f5-36adeda0ffa1

Commits

Reviewing files that changed from the base of the PR and between 94f2e4a and e4c79ca.

Files ignored due to path filters: 4

• Cargo.lock is excluded by !**/*.lock
• keep-agent-py/Cargo.lock is excluded by !**/*.lock
• keep-agent-ts/Cargo.lock is excluded by !**/*.lock
• keep-enclave/enclave/Cargo.lock is excluded by !**/*.lock

Files selected for processing: 2

• deny.toml
• keep-core/Cargo.toml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}