Skip to content
Request access

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

Upgrade crypto-bigint to 0.7.6 and p256 to 0.14 #492

Mergedsyntaqx merged g1t/security/crypto-bigint-0.7.6 into maindependenciesrust

Merged into main by syntaqx via a merge commit in 480122f

g1tbotopened this pull request

Fixes RUSTSEC-2026-0387 (timing variability in crypto-bigint's constant-time operations) for both copies in Cargo.lock:

  • crypto-bigint 0.7.5 → 0.7.6 (g1t's security update).
  • crypto-bigint 0.5.5 is gone: p256 0.13 in services/identity held it, and 0.14 builds on crypto-bigint 0.7. ES256 verification in sso/jwt.rs builds against 0.14 with no code changes. All 236 identity tests pass, and it checks for wasm32.
g1tbotrequested a review from syntaqx·
g1tbotadded the dependencies and rust labels·
g1tbotcommentededited

Dependency review

Passed. 14 dependency changes, none vulnerable.

Cargo.lock

ChangePackageVersionRelationshipLicenseVulnerabilities
Addedcrypto-bigint0.7.6transitiveunknownnone known
Addedctutils0.4.5transitiveunknownnone known
Removedbase16ct0.2.0transitiveunknown
Removedcrypto-bigint0.5.5transitiveunknown
Removedcrypto-bigint0.7.5transitiveunknown
Removedctutils0.4.4transitiveunknown
Removedecdsa0.16.9transitiveunknown
Removedelliptic-curve0.13.8transitiveunknown
Removedff0.13.1transitiveunknown
Removedgroup0.13.0transitiveunknown
Removedp2560.13.2directunknown
Removedprimeorder0.13.6transitiveunknown
Removedrfc69790.4.0transitiveunknown
Removedsec10.7.3transitiveunknown

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

syntaqxchanged the title from “Upgrade crypto-bigint to 0.7.6” to “Upgrade crypto-bigint to 0.7.6 and p256 to 0.14”·
syntaqxadded this to the merge queue·
syntaqxmerged this·
syntaqxdeleted the g1t/security/crypto-bigint-0.7.6 branch·

All checks have passed

4 passed · on fead610

Workflows

CI / pull_request — CI passedDetails
Dependency review — 14 dependency changes, none vulnerableDetails
Preview / pull_request — Preview passedDetails
Self-host / pull_request — Self-host passedDetails

g1t/security/crypto-bigint-0.7.6 was deleted

It can be made again at fead610, where it was.

Sign in to comment.