[tonibergholm-codento]

Summary

 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.5"

ctutils is pulled in by digest 0.11 (through ed25519-dalek in scl-crypto). RUSTSEC-2026-0385 (published today): Choice mask generation and u128 comparisons could compile to branches, patched in 0.4.4. Lock-only; no source change.

Evidence

• Before: cargo audit job fails with RUSTSEC-2026-0385 on ctutils 0.4.2 (seen on feat(forge): P38 F2a repositories API, lifecycle, collaborators, branches #301, unrelated to that PR).
  After: lock resolves ctutils 0.4.5; cargo check --workspace --all-targets and cargo test -p scl-crypto (38 tests) pass.

Merge Danger

Door: two-way.

Blast Radius: one crypto-adjacent transitive dependency used for constant-time operations; patch-level bump of a crate the advisory says is fixed.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 62464a37-1115-4681-9008-e848595435bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T09:01:20.210286Z	1fc649c	PR opened
🔒 Security Review	✅ Completed 2026-10-23T09:03:16.695730Z	1fc649c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tonibergholm-codento]

Superseded: the identical ctutils 0.4.5 lock change landed in #301 (3571fb8), so main already has it.