[fnando]

What

Bumps ctutils 0.4.3 → 0.4.7 (RUSTSEC-2026-0385) and tokio 1.52.3 → 1.54.1 (RUSTSEC-2026-0386) in Cargo.lock, changing only their versions and checksums. Adds RUSTSEC-2026-0387 (crypto-bigint 0.5.5) to the cargo-deny ignore list.

Why

Three new RustSec advisories are failing the cargo-deny (advisories) job on main and every open PR. ctutils and tokio have semver-compatible fixes. crypto-bigint is only fixed in 0.7.6+, but elliptic-curve 0.13 (used by k256/p256 in soroban-env-host and by xrpl-rust in ows-signer) requires 0.5, and no 0.5.x fix exists. In soroban-env-host those curves only verify signatures over public data, and the CLI signs with ed25519, which doesn't use crypto-bigint.

Known limitations

The RUSTSEC-2026-0387 ignore stays until upstream moves to elliptic-curve 0.14.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.52.3 ⏵ 1.54.1	-2

View full report