[cagojeiger]

The RustSec advisory database published RUSTSEC-2026-0385 after the preceding main audit passed. The required audit now rejects ctutils 0.4.2 for non-constant-time mask generation and u128 comparisons.

Update only the locked ctutils patch release to 0.4.4, which RustSec identifies as fixed. Cargo manifests, every other locked package and ctutils dependencies remain unchanged. Keep all existing audit policy and exceptions unchanged.

Sources: https://github.com/RustSec/advisory-db/blob/f7b2f6bc663452200bbe639ebb75e0c762b3422b/crates/ctutils/RUSTSEC-2026-0385.md and RustCrypto/utils#1569.

Validation:

• cargo update -p ctutils --precise 0.4.4 changed only its version and checksum.
• Parsed lockfile comparison confirms all other package fields and metadata are unchanged.
• cargo tree --locked resolves ctutils 0.4.4.
• cargo audit 0.22.2 --deny yanked --json passed with zero vulnerabilities; three existing unmaintained warnings remain.
• git diff --check passed. Full Linux CI is pending.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:38:45.030944Z	7e90376	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.