Cleared RUSTSEC

.cargo/audit.toml

@@ -1,5 +1,12 @@
-# `cargo audit` policy (task 42). Mirrors the `deny.toml` triage: the only
-# known advisory has no patched release and does not apply here (RSA
-# verify-only, never decryption). Re-evaluate when rsa ships a fix.
+# `cargo audit` policy (task 42). Mirrors the `deny.toml` triage.
+# RUSTSEC-2023-0071 (rsa Marvin timing): no patched release exists upstream
+# ("No safe upgrade is available"); this crate uses RSA for signature
+# verification only (JWK-selected `DecodingKey`), never RSA decryption, so
+# the padding-timing oracle does not apply. Re-evaluate when rsa ships a fix.
+# RUSTSEC-2026-0387 (crypto-bigint timing): patched only in crypto-bigint
+# >=0.7.6, which needs p256 0.14 via the still-unmerged jsonwebtoken bump
+# (Keats/jsonwebtoken#536); this is a real exposure on the ES256 signing path
+# (`src/jose/jwt_access.rs`), so drop the ignore as soon as jsonwebtoken
+# releases a p256 0.14 build rather than leaving it in place indefinitely.
 [advisories]
-ignore = ["RUSTSEC-2023-0071"]
+ignore = ["RUSTSEC-2023-0071", "RUSTSEC-2026-0387"]

Cargo.lock

@@ -887,9 +887,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "fe3e9d21d39e6f39ff46e03d5b621424f88ee23d8a1672c6bfc9ccc7f2da4f6a"
 dependencies = [
  "cmov",
 ]
@@ -1261,7 +1261,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2771,7 +2771,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3134,7 +3134,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3869,7 +3869,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4018,9 +4018,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
 [[package]]
 name = "tokio"
-version = "1.53.2"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",

deny.toml

@@ -10,8 +10,14 @@ yanked = "deny"
 # ("No safe upgrade is available"); this crate uses RSA for signature
 # verification only (JWK-selected `DecodingKey`), never RSA decryption, so
 # the padding-timing oracle does not apply. Re-evaluate when rsa ships a fix.
+# RUSTSEC-2026-0387 (crypto-bigint timing): patched only in crypto-bigint
+# >=0.7.6, which needs p256 0.14 via the still-unmerged jsonwebtoken bump
+# (Keats/jsonwebtoken#536); this is a real exposure on the ES256 signing path
+# (`src/jose/jwt_access.rs`), so drop the ignore as soon as jsonwebtoken
+# releases a p256 0.14 build rather than leaving it in place indefinitely.
 ignore = [
   { id = "RUSTSEC-2023-0071", reason = "unpatched upstream; RSA verify-only, never decryption" },
+  { id = "RUSTSEC-2026-0387", reason = "unpatched in the p256 0.13 generation; fixed only in crypto-bigint >=0.7.6 via the unmerged jsonwebtoken p256 0.14 bump (Keats/jsonwebtoken#536); ES256 signing does run through it, so re-evaluate on that release" },
   { id = "RUSTSEC-2026-0374", reason = "unmaintained (no safe upgrade); basic-toml is a compile-time-only dep of the askama_derive proc macro, never in the runtime graph" },
 ]