[DavySc]

Requested by Davy · project thread

What

cargo deny check failed on main: RUSTSEC-2026-0385 (ctutils 0.4.3, pulled in via digest → secret-service) and yanked clipboard-win 5.4.1 (via arboard). Fixed releases exist, so this is cargo update -p ctutils -p clipboard-win (→ 0.4.6 and 5.4.3). Lockfile only: no deny.toml ignore, no dependency trimmed, no source change.

Verified (exit 0)

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace (1135 + 560 + 54 + 29 passed, 0 failed)
• cargo deny check (advisories, bans, licenses, sources ok)

Progress file: docs/progress/2026-10-26-cargo-deny-advisories.md.

---

Generated by Claude Code

[DavySc]

Cross-review: approved (posted as a comment because author and reviewer share one account). Reviewed head 00e6358.

Lock diff. git diff origin/main...pr110 -- Cargo.lock changes exactly two packages: ctutils 0.4.3 → 0.4.6 and clipboard-win 5.4.1 → 5.4.3. Only the version and checksum lines change. No dependency lists change and nothing else gets bumped. The only other file is the progress file.

Versions are genuine. I checked the crates.io API: ctutils 0.4.6 was published 2026-10-25 and clipboard-win 5.4.3 on 2026-10-23. Neither is yanked, and both checksums match the ones in the lock file byte for byte. clipboard-win 5.4.1 (and 5.2.0–5.4.0) are yanked, which confirms the reason for the bump.

Advisory fixed. The local advisory-db copy of RUSTSEC-2026-0385 says patched = [">= 0.4.4"] (upstream RustCrypto/utils#1569), so 0.4.6 is covered.

Main fails, PR passes.

• origin/main (92b8474): cargo deny check exits 1 with advisories FAILED (error[vulnerability] RUSTSEC-2026-0385 on ctutils 0.4.3 via digest 0.11.3 → hkdf → secret-service, plus error[yanked] on clipboard-win 5.4.1 via arboard → egui-winit). Bans, licenses and sources were ok.
• PR head: cargo fmt --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && cargo deny check exits 0. Tests: 1135 + 560 + 54 + 29 passed and 0 failed (1778 in total), which matches the progress file. Output: advisories ok, bans ok, licenses ok, sources ok.

No deny.toml change and no suppressions. This is the smallest honest fix. CI on all 3 systems was still running when I posted this, so the merge waits for it to go green.

---

Generated by Claude Code