From dbd8ec3fadec0657793d8e6ef75f668e6f705170 Mon Sep 17 00:00:00 2001 From: alpha Date: Sat, 11 Jul 2026 10:05:48 +0800 Subject: [PATCH] fix(deps): bump cmov 0.5.3 -> 0.5.4 (GHSA-3rjw-m598-pq24) Resolves Dependabot alerts #2 and #3, which are the same vulnerability (GHSA-3rjw-m598-pq24 / CVE-2026-50185) reported once per lockfile: - #2: root Cargo.lock - #3: tools/okb-gen/Cargo.lock cmov's aarch64 Cmov/CmovEq inline asm assumed zero-extension of sub-register-width loads, but the high bits are undefined per the Rust reference, causing csel to pick the wrong branch after a narrowing cast. Fixed in cmov 0.5.4. Both workspaces resolved the same transitive chain to the vulnerable 0.5.3: oak-keyring -> keepass 0.12.9 -> digest 0.11.3 -> ctutils 0.4.2 -> cmov. Updated both independent Cargo.lock files. Verified: release build + full test suite pass on both workspaces. --- Cargo.lock | 4 ++-- tools/okb-gen/Cargo.lock | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 624dc82a..b308fd30 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -533,9 +533,9 @@ dependencies = [ [[package]] name = "cmov" -version = "0.5.3" +version = "0.5.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" [[package]] name = "compact_str" diff --git a/tools/okb-gen/Cargo.lock b/tools/okb-gen/Cargo.lock index fdad38dd..c03c9901 100644 --- a/tools/okb-gen/Cargo.lock +++ b/tools/okb-gen/Cargo.lock @@ -527,9 +527,9 @@ dependencies = [ [[package]] name = "cmov" -version = "0.5.3" +version = "0.5.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746" +checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a" [[package]] name = "compact_str" @@ -2148,7 +2148,7 @@ dependencies = [ [[package]] name = "oak-keyring" -version = "0.8.0-preview.1" +version = "0.8.0-preview.2" dependencies = [ "aes 0.8.4", "arboard",