[BattermanZ]

Summary

 Cargo.lock
-ctutils       0.4.3   RUSTSEC-2026-0385
+ctutils       0.4.5
-tokio         1.53.1  RUSTSEC-2026-0386
+tokio         1.54.1
-crypto-bigint 0.7.5   RUSTSEC-2026-0387  (p256 0.14, tests only)
+crypto-bigint 0.7.6
 crypto-bigint 0.5.5   RUSTSEC-2026-0387  (webauthn-rs, no 0.5 fix) -> excused in deny.toml
 ui/package-lock.json
-undici        8.11.2  GHSA-xjj6-f33q-929c (high, jsdom, tests only)
+undici        8.12.3
 ui/npm-audit-exceptions.json
-GHSA-vfj7-8cjw-p6xm braces   (GitHub withdrew it on 2026-10-23)

Every move is cargo update -p <crate> or npm update undici. Nothing was typed by hand.

The ticket names two advisories. Three more turned up after it was written, and the audit can't pass without them:

• RUSTSEC-2026-0387, crypto-bigint 0.5.5. It comes in through webauthn-rs -> crypto-glue -> elliptic-curve 0.13, and only 0.7.6 and later carry the fix. I read the passkey crates: outside their tests they never sign and hold no private key, and checking a signature uses only public numbers. That is the reasoning behind the existing RSA entry (RUSTSEC-2023-0071), and the new entry sits beside it.
• undici, a high-severity advisory, reached through jsdom, which only the tests use.
• braces: GitHub withdrew GHSA-vfj7-8cjw-p6xm (withdrawn_at: 2026-10-23T12:53:02Z), so the audit now flags its excuse as stale.

Side effect in Cargo.lock: when tokio is unlocked, Cargo re-points six crates that accept either version from windows-sys 0.61.2 to 0.52.0, which was already in the tree. The same happens with --precise 1.53.3. Only Windows builds are touched.

No changelog line. Passkeys (#370) are still under ## Unreleased, and v0.3.0's Cargo.lock had neither ctutils nor webauthn-rs, so no released Kamosu ever shipped the affected code. AGENTS.md says a fix to something still unreleased gets no line of its own.

Evidence

• Before: just audit fails on RUSTSEC-2026-0385, -0386 and -0387, and on undici GHSA-xjj6-f33q-929c.
  After: advisories ok / npm audit: nothing at high or critical that is not excused. / both dependency trees are clean at the levels this gate enforces.
• just check passes. just test passes: every Rust suite, tests/passkeys.rs (9 tests) among them, and 1401 screen tests.
• Live, on the dev instance running this build (tokio 1.54.1 confirmed in the binary), with Chrome's virtual authenticator: Settings › Account › Add a passkey added one, the browser was cleared of its Session, and Log in with a passkey signed it back in as the dev account. There were no page errors. The test passkey and its Session were then removed.

Merge Danger

Door: two-way

Blast Radius: small

These are lock-file moves inside the ranges Cargo.toml and package.json already allow, plus two audit-config edits. A revert is one commit.