[baxen]

Summary

RustSec published RUSTSEC-2026-0387 against crypto-bigint. Some of its operations meant to be constant-time could compile to code that branches on secret values. Since the advisory came out, cargo-deny check reports advisories as failed. That breaks Security Domain / Security on main and on every PR that runs the Rust security job (for example #8575 and #8579).

crypto-bigint 0.5.5 came in only through p256 0.13 → elliptic-curve 0.13 in buzz-push-gateway. The advisory has no 0.5.x fix; the patched line is 0.7.6+. This PR moves buzz-push-gateway to p256 0.14, which uses crypto-bigint 0.7.9.

Advisory	Crate	Change
RUSTSEC-2026-0387	crypto-bigint	0.5.5 → 0.7.9 (via p256 0.13.2 → 0.14.0)

Code changes: p256 0.14 renamed the SEC1 encoder from ToEncodedPoint::to_encoded_point to ToSec1Point::to_sec1_point. The gateway calls it in two places, both to re-encode an App Attest public key as uncompressed SEC1 bytes. The tests call it in five more. Nothing else in the gateway's API use changed.

Lockfile: only the p256 dependency chain changes: ecdsa, elliptic-curve, ff, group, primeorder, rfc6979 and sec1 move up a minor version. primefield and wnaf are added. The old der/spki/pkcs8/pem-rfc7468/const-oid 0.x versions that only this chain used are removed. desktop/src-tauri/Cargo.lock and the buzz-feature-flags fixture lockfile don't contain crypto-bigint, so they're unchanged.

Exposure, for context: in production the gateway uses p256 only to verify App Attest signatures against public keys. Signing with a private key happens only in tests. So the timing issue didn't realistically apply here, but the bump clears the advisory instead of ignoring it.

Related issue

N/A. I searched open and closed PRs for RUSTSEC-2026-0387 and crypto-bigint and found none.

Testing

• cargo-deny check: advisories ok, bans ok, licenses ok, sources ok. On origin/main the Security job fails on this advisory.
• cargo test -p buzz-push-gateway --all-features: 82 passed, 18 ignored (the same tests are #[ignore] on main).
• cargo clippy -p buzz-push-gateway --all-targets --all-features -- -D warnings is clean.
• cargo check --workspace --all-targets passes.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T23:12:18.652688Z	e04bd14	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 9e8c9fc04daf20259cd259dcaec89109587cc7f5...e04bd14f48a27caa178a0f5e360f9e89aa826756
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete regressions found in the p256 upgrade or associated API changes after tracing enrollment, key serialization, assertion verification, and relevant tests.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only static inspection. Builds and tests were not run, as instructed.

---

_{Generated by Codex Security Review |
Requested by: @baxen |
Workflow run}