[loveRhythm1990]

Capability assessment: N/A: This is a transitive dependency patch update; it does not change Astra capabilities or configuration.

Summary

Current main and #1126 fail cargo-audit because ctutils 0.4.3 is affected by RUSTSEC-2026-0385. Update only Cargo.lock to ctutils 0.4.4, including its registry checksum. The advisory concerns non-constant-time mask generation and u128 comparisons.

This is the exact lockfile patch already present in #1125 at 936cf0b23dd7337c361c82272831273c62baea55, extracted so the security fix can be reviewed independently of release preparation. No audit command, threshold or exemption is changed.

Advisory: RustSec RUSTSEC-2026-0385, patched in >=0.4.4.

Related issue

Unblocks the dependency audit for #1126; reuses the fix from #1125.

Change type

• Bug fix
• Build, CI, or maintenance

User and compatibility impact

Compatible patch upgrade within the existing dependency constraints. No release version, workflow or application source changes. Existing audit exceptions are unchanged.

Architecture and complexity delta

N/A. One existing lockfile entry changes, +2/-2.

Verification

Base: 8cbabcce326e4cdb8f1f84cf5f5a37964ae242fd.

• cargo metadata --locked --format-version 1: passed, resolving ctutils 0.4.4 (781 packages).
• Cargo-audit 0.22.1 against fixed latest advisory DB 84d943a6deeb8cc6c6f632531aaf4f1c62275239: base lockfile fails with RUSTSEC-2026-0385/ctutils 0.4.3; patched lockfile passes with zero blocking vulnerabilities. Existing warning categories are retained.
• Patch matches chore(release): 准备 Astra 0.2.14 #1125's dependency fix exactly.
• git diff --check: passed.

Full workspace Rust tests were not run locally. The transitive crate cannot be selected for standalone Cargo tests from this workspace because it is not a workspace member; no upstream tests were copied or replaced. PR CI will exercise the workspace. Database verification is not applicable.

Final checklist

• Locked dependency resolution and before/after audit are validated.
• No public contract documentation change is needed.
• No credentials, private endpoints or generated files.
• Conventional Commit title.