[M3gA-Mind]

Summary

• Bumps ctutils from 0.4.2 to 0.4.4 in Cargo.lock. This fixes RUSTSEC-2026-0385: non-constant-time mask generation and u128 comparisons.
• 0.4.4 is the first patched release. Its dependencies are the same as 0.4.2's (cmov ^0.5.3, with subtle optional). Its MSRV of 1.87 is below this crate's rust-version = "1.94".
• The lock diff is 4 lines: version and checksum of the ctutils entry only.

Why

module-ci / supply-chain and storage-boundary are red on main at 6d01906 because of this one advisory.

• storage-boundary runs cargo deny itself. Its toolchain and install-action steps succeed (for example run 39929899435, job 120335669248, at 09:11:21Z). The job then fails on the same RUSTSEC-2026-0385. It is not an install-action or workflow-pin problem.
• RUSTSEC-2026-0381 shows only as an advisory-not-detected warning for its existing ignore entry. It doesn't fail the job.

Test plan

• cargo deny check and a workspace build and test, run off-GitHub on the cuttlefish check host.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 590de3c2c6534905bc91976be63b90eb85d4ba8c

Verdict: Ready for maintainer review · Priority: none
Coverage: File coverage is unavailable.
Pull request purpose (title): fix(deps): bump ctut…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(deps): bump ctutils to 0.4.4 for RUSTSEC-2026-0385. Tiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

security

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `95e0e9f6b466`), so retrieved context may be out of date._

description

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

Evidence and run details

• Models: ladder/vectors-oai3
• Spend: $0.000002
• Tokens: 0 input · 0 output · 0 cached · 24 embedding
• Updated: 2026-10-23T12:06:21Z

Head	State	Pass summary
590de3c2c653	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T12:06:21Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2f642117-5d28-45e3-a7ce-b59df24eed49

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0000