ci: update Tokio and document crypto-bigint exception

.cargo/audit.toml

@@ -8,4 +8,9 @@ ignore = [
     # coordinated revm upgrade. cargo-deny's resolved graph omits this edge;
     # only the raw-lockfile cargo-audit scan flags it, hence audit-only.
     "RUSTSEC-2025-0055",
+    # Same scoped crypto-bigint exception and removal conditions as deny.toml.
+    # The audited node paths verify/recover public inputs; Conflux secp256k1
+    # signing and ECDH use libsecp256k1. Reassess before adding secret-input
+    # RustCrypto operations.
+    "RUSTSEC-2026-0387",
 ]

Cargo.toml

@@ -275,7 +275,8 @@ tower = "0.5"
 tower-http = "0.6"
 
 # async
-tokio = "1.48"
+# 1.53.3 fixes RUSTSEC-2026-0386 without allowing the affected 1.52 release.
+tokio = "1.53.3"
 tokio-stream = "0.1"
 tokio-test = "0.4"
 futures = "0.3"

deny.toml

@@ -93,6 +93,14 @@ ignore = [
     # Track https://github.com/estk/log4rs/issues/436 and remove this exception
     # once a release drops the dependency; cargo-deny also warns on unused ignores.
     "RUSTSEC-2024-0449",
+    # crypto-bigint 0.5 is required by Alloy's k256 0.13 and REVM's
+    # k256/p256 0.13. RUSTSEC-2026-0387 concerns timing leaks of secret inputs;
+    # the audited node paths use these crates for public-input signature
+    # verification/recovery. Conflux secp256k1 signing and ECDH use libsecp256k1.
+    # Reassess before introducing secret-input RustCrypto operations. Remove
+    # when all three lockfiles resolve crypto-bigint >=0.7.6 or drop the crate.
+    # https://rustsec.org/advisories/RUSTSEC-2026-0387.html
+    "RUSTSEC-2026-0387",
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.