cargo audit red on main: RUSTSEC-2026-0387 (crypto-bigint 0.5.5 via aws-config credentials-login)

Open Beginner friendly
  • Is something wrong?
#1,183 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@sdairs is already working on this.

Since Nov 2, 2026.

  • #1184 by @sdairs — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
aws, rust
Domain
build-system, documentation

Research direction

The failing check is audit.yml running cargo audit --deny warnings. The unwanted crate enters through the credentials-login feature of the aws-config dev-dependency of clickhouse-cloud-api, so start with that entry in the manifest and then check Cargo.lock. Done means cargo audit passes, crypto-bigint 0.5.5 is gone from the lockfile, and the API README has the aws login workaround described in the issue.

Written by the indexing model from the issue text.

Description

Problem

Security audit (audit.yml, cargo audit --deny warnings) has failed on every scheduled main run since 2026-10-27 (latest: https://github.com/ClickHouse/clickhousectl/actions/runs/41398840725). It also fails on every PR that touches the manifest or lockfile.

Crate:    crypto-bigint
Version:  0.5.5
Title:    Multiple timing variability issues in operations intended to be constant-time
ID:       RUSTSEC-2026-0387
Solution: Upgrade to >=0.7.6

Cause

The crate reaches us only through a dev-dependency of clickhouse-cloud-api. It does not ship in the clickhousectl binary or the published library:

crypto-bigint 0.5.5
└── elliptic-curve 0.13.8 ── ecdsa 0.16.9 / primeorder 0.13.6
    └── p256 0.13.2
        └── aws-config 1.13.0  (feature `credentials-login`)
            [dev-dependencies] clickhouse-cloud-api

credentials-login was enabled in 695aa138 so the ignored ClickPipes E2E tests (tests/clickpipes/) can read aws login sessions. CI never runs those suites.

There is no patched 0.5.x release, so a lockfile update can't fix it. Upstream merged the move to p256 0.14 in smithy-lang/smithy-rs#4970 (fixes awslabs/aws-sdk-rust#1471) on 2026-10-30. That change is in aws-config 1.13.1, which isn't published yet; 1.13.0 is the latest on crates.io.

Fix

  • Drop the credentials-login feature from the aws-config dev-dependency. This removes p256 0.13, crypto-bigint 0.5.5 and 20 other crates from Cargo.lock. No crate versions are bumped.
  • Document the workaround for aws login users in the API README: eval "$(aws configure export-credentials --format env)". The default chain still covers env vars, profiles, SSO and credential_process.

Follow-up

Once aws-config ≥ 1.13.1 is on crates.io, bump it, restore credentials-login, and remove the README workaround. Dependabot's weekly Cargo group should pick up the bump.

Dominant language
Rust
Stars
80
Forks
9
Avg merge
2d 18h
Merged PRs (30d)
51

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ClickHouse/clickhousectl

All issues in ClickHouse/clickhousectl

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.