[alangou]

Summary

Update rustix to 1.1.6 across all 12 tracked Cargo lockfiles for RUSTSEC-2026-0486, which concerns uninitialized memory in extended-attribute buffer handling. Correct the RSA exception explanation now that a patched release exists but cannot resolve with the published SSH dependencies.

Related Issue

N/A. No covering issue, per user instruction.

Changes

• One dependency commit upgrades rustix 1.1.4 or 1.1.5 to 1.1.6 in root, E2E, examples, runner, tmachine, and all five aligned test workspaces. Unaffected rustix 0.38.44 remains.
• Native Cargo updates also rebind some Windows-only references among existing windows-sys versions within parent constraints. No other package versions change.
• A separate RSA commit retains RUSTSEC-2023-0071 and records the actual blocker. Published russh 0.65.0 and 0.65.1 pin rsa 0.10.0-rc.18 and ssh-key 0.7.0-rc.11. A resolver probe confirms conflict with patched rsa 0.10.0. Remove after a released russh permits patched RSA and all SSH and fixture occurrences are upgraded and validated. Advisory, published pins.
• Reassessed and retained the unchanged SQLite exception, RUSTSEC-2026-0459. SQLx 0.9.0 still requires libsqlite3-sys <0.38.0; the fix accepting patched >=0.39.0 is merged but unreleased. Remove after a compatible SQLx release and validation across all ten affected locks.
• No exceptions added or removed. Both retained vulnerabilities remain unresolved. No source-code, test, build, manifest, or generated-interface changes were needed.

Release Notes

Updates the Rust filesystem dependency for an upstream memory-safety advisory.

Testing

• Required local validation complete.
• Full root cargo-deny task, including crypto policy regression checks, passes.
• All 11 independent locked advisory scans pass with the configured exceptions.
• All 12 lockfiles pass locked metadata and all five alignment checks pass.
• Rust formatting and workspace compile checks pass, including sandbox perf-harness.
• V8 example test targets compile and link. They contain zero tests.
• Independent diff review and checksum verification pass.
• Full maintained Rust test matrix and Clippy matrix, including normal parallel sandbox execution.
• Local Docker conformance lane: 22 passed, 0 failed.
• Remote CI/E2E for the final PR head.

test:e2e is applied. SHA-bound admission created the matching mirror. Branch Checks passed. Branch E2E Checks, attempt 1 is running the test suites with no failed jobs reported at the latest check; the remote E2E outcome is pending. Review Readiness failed while its automation attempted to request reviewers; its log does not expose the underlying HTTP error. PR Issue Acceptance and DCO passed.

All open Dependabot pages were read successfully; there were no open alerts. Baseline root and V8 advisory scans failed for rustix. The final configured scans pass. A diagnostic scan with both exceptions unmasked still reports RSA and SQLite, as expected. Initial test and Clippy attempts exhausted the temporary filesystem; build artifacts were moved to a larger disk-backed cache before rerunning.

Validation used Rust 1.95.0 and cargo-deny 0.20.2 on c2c9d1cf4edc61142dd5d24b23b1e1cbfae8d269, based on main f1ce6930710a76a5fac4d423b2c1b318ace3839b. Main was fetched again before publication and remained unchanged. The RustSec database was refreshed on November 11.

Earlier parallel sandbox attempts failed two different socket assertions. Both passed in the final standard matrix, and the full sandbox suite passed 307/307. Baseline sandbox runs passed twice; the intermittent failures' cause remains unproven. A diagnostic globally serial run stalled in a subprocess fixture and was stopped. The final run used normal concurrency, included installed /usr/sbin tools on PATH, and used an isolated TMPDIR. Docker conformance initially failed one upload because an unrelated /tmp/.git marker interfered with repository discovery; all 22 scenarios passed with isolated temporary storage. No tests were disabled or changed.

Checklist

• Follows Conventional Commits.
• Both commits are signed off for DCO.
• Architecture docs are not applicable to these dependency and exception changes.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/5485 does not exist yet. A maintainer needs to comment /ok to test c2c9d1cf4edc61142dd5d24b23b1e1cbfae8d269 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[alangou]

/ok to test c2c9d1c