[Pana]

Cargo deny and cargo audit report security advisories in the current dependency graph. Upgrade Tokio to fix RUSTSEC-2026-0386, and document a temporary exception for the upstream-blocked crypto-bigint advisory RUSTSEC-2026-0387.

• Raise the workspace Tokio minimum from 1.48 to 1.53.3, which fixes the AsyncFd I/O safety advisory. Update the root and both tool lockfiles, including the required mio, socket2, libc, and tokio-macros dependencies.
• Add a synchronized crypto-bigint exception in deny.toml and .cargo/audit.toml, with its scope and removal conditions. The locked Alloy/revm stack uses k256/p256 through elliptic-curve 0.13, which requires crypto-bigint 0.5; the fix requires >=0.7.6. Even the currently published revm-precompile 43.0.3 and alloy-primitives 1.7.3 still require k256/p256 0.13. These paths process public signature recovery/verification inputs, while transaction signing uses cfxkey's libsecp256k1 backend. Reassess before introducing RustCrypto secret-key operations and remove the exception once the upstream stack supports a patched version. This exception does not patch the underlying crypto-bigint dependency.

Validation:

• Reproduced RUSTSEC-2026-0386 with the same cargo-deny 0.20.2 used by CI before upgrading Tokio.
• With cargo-deny 0.20.2: ./dev-support/cargo_all.sh deny --locked check --hide-inclusion-graph passed for consensus_bench, evm-spec-tester, and the root workspace.
• cargo audit --no-fetch passed for all three lockfiles; the Tokio advisory is absent. Other pre-existing warnings remain.
• cargo test --locked -p cfx-tasks --all-features passed: 13 unit tests and 2 doc tests.
• git diff --check passed.

---

This change is 

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-26T06:05:30.432080Z We couldn’t complete this review. Comment @codex review to try again.	115842b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• Cargo.toml

Incremental review of 115842bebdadc5281335c661c441021a9a07604c..ff3e38802312ff3e6c7b9e6a5ebf81b0fe803f09. Reviewed the complete workspace manifest, Tokio dependency declarations, tool manifests, and pinned Rust toolchain for context. No high-confidence issues were identified in the changed manifest lines.

The three generated Cargo lockfiles were excluded from substantive review per the review scope. The advisory exception files are unchanged since the previous review and were not re-reviewed. No existing inline findings required reconciliation.

Validation was static only. Builds, tests, and cargo audit/deny commands were not run under the read-only restrictions.

Previous Review Summary (commit 115842b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 115842b)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .cargo/audit.toml
• deny.toml

The advisory exceptions are synchronized and document the dependency constraint, current public-input usage, and reassessment/removal conditions. This suppresses the advisory rather than patching the dependency.

Validation was limited to static review of the diff, complete changed files, dependency manifests/lockfiles, and relevant cryptographic call sites. Tests and cargo audit/deny commands were not run under the read-only review restrictions.

---

_{Reviewed by gpt-6.1-sol · Input: 24 · Output: 1.8K · Cached: 209.6K}

[peilun-conflux]

@peilun-conflux reviewed 6 files and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on Pana).