🔥 Jadwal & Hasil: atuinsh/atuin/issues/

BinaryMuse · 2026-10-23T18:01:19Z

The cargo-deny step on the atuin pipeline fails on RUSTSEC-2026-0385 (ctutils < 0.4.4: non-constant-time mask generation, reached through digest → hmac → hkdf → sqlx-postgres). Running the same check locally turned up two more failures on main, so this clears all three:

ctutils 0.4.2 → 0.4.5 for RUSTSEC-2026-0385.
tokio 1.52.3 → 1.54.1 for RUSTSEC-2026-0386 (AsyncFd::new accepts any AsRawFd, which breaks I/O safety).
clipboard-win 5.4.1 → 5.4.3, since 5.4.1 is yanked.

Tokio 1.54 deprecates AsyncFd::new in favour of the unsafe AsyncFd::register, and clippy runs with -D warnings, so AsyncTty::new now calls register. The File owns the descriptor and AsyncTty never exposes it mutably, which is exactly the invariant register asks the caller to uphold.

The windows-sys edge changes in Cargo.lock are cargo re-picking among the three windows-sys versions already in the lockfile while re-resolving tokio; no package versions change beyond the three above.

socket-security · 2026-10-23T18:01:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/tokio@1.52.3 ⏵ 1.54.1	^-2

View full report

greptile-apps · 2026-10-23T18:03:55Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

Updates dependencies and adapts terminal registration to Tokio’s replacement API.

The workspace uses updated Tokio, crypto, and Windows clipboard crates.
Unix terminals now register with Tokio through AsyncFd::register.

_{Reviews (1) · Last reviewed commit: "fix(deps): bump ctutils and tokio for RU..." · Reviewed by Greptile}

BinaryMuse · 2026-10-23T18:09:15Z

/merge

BinaryMuse · 2026-10-23T18:10:19Z

+        let file = File::from(fd);
+        // SAFETY: `file` owns the descriptor, and `AsyncTty` never hands out a mutable reference
+        // to it, so it stays open and unchanged for as long as the `AsyncFd` lives.
+        #[allow(unsafe_code, reason = "registering an owned descriptor with the reactor")]
+        let inner = unsafe { AsyncFd::register(file) }?;
+        Ok(Self(inner))


Merging to unblock main, but open to opinions here.

atuin-bot · 2026-10-23T18:11:05Z

Landed as 98fc62b. GitHub shows this merged once it reaches main.

) The `cargo-deny` step on the atuin pipeline fails on [RUSTSEC-2026-0385](https://rustsec.org/advisories/RUSTSEC-2026-0385) (`ctutils` < 0.4.4: non-constant-time mask generation, reached through `digest` → `hmac` → `hkdf` → `sqlx-postgres`). Running the same check locally turned up two more failures on `main`, so this clears all three: * `ctutils` 0.4.2 → 0.4.5 for RUSTSEC-2026-0385. * `tokio` 1.52.3 → 1.54.1 for [RUSTSEC-2026-0386](https://rustsec.org/advisories/RUSTSEC-2026-0386) (`AsyncFd::new` accepts any `AsRawFd`, which breaks I/O safety). * `clipboard-win` 5.4.1 → 5.4.3, since 5.4.1 is yanked. Tokio 1.54 deprecates `AsyncFd::new` in favour of the `unsafe` `AsyncFd::register`, and clippy runs with `-D warnings`, so `AsyncTty::new` now calls `register`. The `File` owns the descriptor and `AsyncTty` never exposes it mutably, which is exactly the invariant `register` asks the caller to uphold. The `windows-sys` edge changes in `Cargo.lock` are cargo re-picking among the three `windows-sys` versions already in the lockfile while re-resolving tokio; no package versions change beyond the three above.

### Bug Fixes - *(ai)* Parse history and output tool arguments with serde and reject unknown ones ([#4554](#4554)) - *(client)* Keep the logging guard alive until the command finishes ([#4528](#4528)) - *(daemon)* Build kv and scripts after a sync, not only history ([#4544](#4544)) - *(daemon,sync)* Rebuild search index after `atuin sync` ([#4574](#4574)) - *(deps)* Bump ctutils and tokio for RUSTSEC-2026-0385 and -0386 ([#4525](#4525)) - *(deps)* Bump bandit to 1.14.0 and zstd to 0.14 for the open security advisories - *(deps)* Bump docs gitpython to 3.2.1 for GHSA-83vg-56qc-22m7 ([#4559](#4559)) - *(deps)* Bump pulldown-cmark to 0.13.5 ([#4581](#4581)) - *(docker)* Ship patched ca-certificates in the server image ([#4522](#4522)) - *(i18n)* Say force *pull* in the store pull --force help ([#4523](#4523)) - *(login)* Restart the daemon on the new key when login changes it ([#4555](#4555)) - *(mcp)* Reject arguments a tool doesn't take instead of ignoring them ([#4553](#4553)) - *(pty-proxy)* Don't auto-spawn on Linux virtual consoles ([#4564](#4564)) - *(release)* Regenerate CONTRIBUTORS on every release ([#4561](#4561)) - *(scripts)* Name the editor when launching it fails ([#4533](#4533)) - *(server)* Check the password before deleting an account ([#4572](#4572)) - *(sync)* Stop re-downloading history the server doesn't have - *(threads)* Stop reading claude code api-request blobs as messages ([#4538](#4538)) - *(threads)* Keep opencode subagent prompts and other dropped content ([#4546](#4546)) - *(threads)* Keep Claude Code recaps, safeguard notices, retried API errors and skill prompts ([#4547](#4547)) - *(threads)* Keep omp python runs, file mentions, narration and subagent links ([#4548](#4548)) - *(threads)* Keep codex subagent answers and voice transcripts, read compressed rollouts ([#4549](#4549)) - *(threads)* Ignore enter_accept for resume ([#4573](#4573)) - Undo i18n of `__internal` docs ([#4560](#4560)) ### Features - *(cli)* Categorized help via clap-couture ([#4384](#4384)) - *(common)* Userio::log macros and sinks for user messages ([#4562](#4562)) - *(dist)* Add a Windows MSI installer for atuin ([#4527](#4527)) - *(mcp)* Install for all configured agents with `atuin mcp install` ([#4557](#4557)) - *(search)* Add shell-up-key-binding keybinding condition ([#4552](#4552)) - *(server)* Add admin commands to create, reset and delete users ([#4526](#4526)) - *(threads)* Say how long writing the session file took before starting the harness ([#4537](#4537)) - More correct numeric math ([#4585](#4585)) ### Miscellaneous Tasks - Skip nix build, illumos and package on mono's land/* builds ([#4551](#4551)) - Move the Windows jobs to Buildkite ([#4571](#4571)) ### Performance - Improve search index performance ([#4586](#4586)) ### Refactor - *(client)* Report a wrong encryption key through a typed error ([#4529](#4529)) - *(deps)* Bump axoupdater from 0.10.0 to 0.10.3 ([#4539](#4539)) - *(deps)* Bump futures-util from 0.3.33 to 0.3.34 ([#4540](#4540)) - *(deps)* Bump serde_json from 1.0.151 to 1.0.154 ([#4541](#4541)) - *(deps)* Bump tokio-util from 0.7.19 to 0.7.20 ([#4542](#4542)) - *(deps)* Bump serde_with from 3.21.0 to 3.24.0 ([#4543](#4543)) - *(pty-proxy)* Clean up tty ownership checks ([#4565](#4565)) ### Testing - *(secrets)* Remove the redaction timing tests ([#4566](#4566))

##### [\`18.24.4\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18244) ##### Bug Fixes - *(ai-session)* Keep the objective of an opencode /goal ([#4599](atuinsh/atuin#4599)) - *(hooks)* Honour CLAUDE_CONFIG_DIR when installing Claude Code hooks ([#4597](atuinsh/atuin#4597)) - *(threads)* Open pi and omp sessions on the agent's default model ([#4598](atuinsh/atuin#4598)) - *(threads)* Take `claude` and `claude-code` alike wherever a harness is named ([#4602](atuinsh/atuin#4602)) - *(threads)* Restore a non-diverged session with no row before its parent ([#4604](atuinsh/atuin#4604)) ##### Features - *(cli)* Spooky atuin ([#4605](atuinsh/atuin#4605)) - *(threads)* Capture, search and resume GitHub Copilot CLI sessions ([#4567](atuinsh/atuin#4567)) - *(threads)* Capture Copilot subagents as child sessions ([#4568](atuinsh/atuin#4568)) - *(threads)* Write Copilot sessions: restore, catch up, switch, fork, continue ([#4580](atuinsh/atuin#4580)) - *(threads)* Name the recording host in threads JSON and atuin info ([#4600](atuinsh/atuin#4600)) - *(server)* Add support for X-Forwarded-For ([#4595](atuinsh/atuin#4595)) --- ##### [\`18.24.3\`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18243) ##### Bug Fixes - *(ai)* Parse history and output tool arguments with serde and reject unknown ones ([#4554](atuinsh/atuin#4554)) - *(client)* Keep the logging guard alive until the command finishes ([#4528](atuinsh/atuin#4528)) - *(daemon)* Build kv and scripts after a sync, not only history ([#4544](atuinsh/atuin#4544)) - *(daemon,sync)* Rebuild search index after `atuin sync` ([#4574](atuinsh/atuin#4574)) - *(deps)* Bump ctutils and tokio for RUSTSEC-2026-0385 and -0386 ([#4525](atuinsh/atuin#4525)) - *(deps)* Bump bandit to 1.14.0 and zstd to 0.14 for the open security advisories - *(deps)* Bump docs gitpython to 3.2.1 for GHSA-83vg-56qc-22m7 ([#4559](atuinsh/atuin#4559)) - *(deps)* Bump pulldown-cmark to 0.13.5 ([#4581](atuinsh/atuin#4581)) - *(docker)* Ship patched ca-certificates in the server image ([#4522](atuinsh/atuin#4522)) - *(i18n)* Say force *pull* in the store pull --force help ([#4523](atuinsh/atuin#4523)) - *(login)* Restart the daemon on the new key when login changes it ([#4555](atuinsh/atuin#4555)) - *(mcp)* Reject arguments a tool doesn't take instead of ignoring them ([#4553](atuinsh/atuin#4553)) - *(pty-proxy)* Don't auto-spawn on Linux virtual consoles ([#4564](atuinsh/atuin#4564)) - *(release)* Regenerate CONTRIBUTORS on every release ([#4561](atuinsh/atuin#4561)) - *(scripts)* Name the editor when launching it fails ([#4533](atuinsh/atuin#4533)) - *(server)* Check the password before deleting an account ([#4572](atuinsh/atuin#4572)) - *(sync)* Stop re-downloading history the server doesn't have - *(threads)* Stop reading claude code api-request blobs as messages ([#4538](atuinsh/atuin#4538)) - *(threads)* Keep opencode subagent prompts and other dropped content ([#4546](atuinsh/atuin#4546)) - *(threads)* Keep Claude Code recaps, safeguard notices, retried API errors and skill prompts ([#4547](atuinsh/atuin#4547)) - *(threads)* Keep omp python runs, file mentions, narration and subagent links ([#4548](atuinsh/atuin#4548)) - *(threads)* Keep codex subagent answers and voice transcripts, read compressed rollouts ([#4549](atuinsh/atuin#4549)) - *(threads)* Ignore enter_accept for resume ([#4573](atuinsh/atuin#4573)) - Undo i18n of `__internal` docs ([#4560](atuinsh/atuin#4560)) ##### Features - *(cli)* Categorized help via clap-couture ([#4384](atuinsh/atuin#4384)) - *(common)* Userio::log macros and sinks for user messages ([#4562](atuinsh/atuin#4562)) - *(dist)* Add a Windows MSI installer for atuin ([#4527](atuinsh/atuin#4527)) - *(mcp)* Install for all configured agents with `atuin mcp install` ([#4557](atuinsh/atuin#4557)) - *(search)* Add shell-up-key-binding keybinding condition ([#4552](atuinsh/atuin#4552)) - *(server)* Add admin commands to create, reset and delete users ([#4526](atuinsh/atuin#4526)) - *(threads)* Say how long writing the session file took before starting the harness ([#4537](atuinsh/atuin#4537)) - More correct numeric math ([#4585](atuinsh/atuin#4585)) ##### Miscellaneous Tasks - Skip nix build, illumos and package on mono's land/\* builds ([#4551](atuinsh/atuin#4551)) - Move the Windows jobs to Buildkite ([#4571](atuinsh/atuin#4571)) ##### Performance - Improve search index performance ([#4586](atuinsh/atuin#4586)) ##### Refactor - *(client)* Report a wrong encryption key through a typed error ([#4529](atuinsh/atuin#4529)) - *(deps)* Bump axoupdater from 0.10.0 to 0.10.3 ([#4539](atuinsh/atuin#4539)) - *(deps)* Bump futures-util from 0.3.33 to 0.3.34 ([#4540](atuinsh/atuin#4540)) - *(deps)* Bump serde_json from 1.0.151 to 1.0.154 ([#4541](atuinsh/atuin#4541)) - *(deps)* Bump tokio-util from 0.7.19 to 0.7.20 ([#4542](atuinsh/atuin#4542)) - *(deps)* Bump serde_with from 3.21.0 to 3.24.0 ([#4543](atuinsh/atuin#4543)) - *(pty-proxy)* Clean up tty ownership checks ([#4565](atuinsh/atuin#4565)) ##### Testing - *(secrets)* Remove the redaction timing tests ([#4566](atuinsh/atuin#4566))

…) (#2495) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/atuinsh/atuin](https://github.com/atuinsh/atuin) | patch | `18.24.2` → `18.24.4` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>atuinsh/atuin (ghcr.io/atuinsh/atuin)</summary> ### [`v18.24.4`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18244) [Compare Source](atuinsh/atuin@v18.24.3...v18.24.4) ##### Bug Fixes - *(ai-session)* Keep the objective of an opencode /goal ([#4599](atuinsh/atuin#4599)) - *(hooks)* Honour CLAUDE_CONFIG_DIR when installing Claude Code hooks ([#4597](atuinsh/atuin#4597)) - *(threads)* Open pi and omp sessions on the agent's default model ([#4598](atuinsh/atuin#4598)) - *(threads)* Take `claude` and `claude-code` alike wherever a harness is named ([#4602](atuinsh/atuin#4602)) - *(threads)* Restore a non-diverged session with no row before its parent ([#4604](atuinsh/atuin#4604)) ##### Features - *(cli)* Spooky atuin ([#4605](atuinsh/atuin#4605)) - *(threads)* Capture, search and resume GitHub Copilot CLI sessions ([#4567](atuinsh/atuin#4567)) - *(threads)* Capture Copilot subagents as child sessions ([#4568](atuinsh/atuin#4568)) - *(threads)* Write Copilot sessions: restore, catch up, switch, fork, continue ([#4580](atuinsh/atuin#4580)) - *(threads)* Name the recording host in threads JSON and atuin info ([#4600](atuinsh/atuin#4600)) - *(server)* Add support for X-Forwarded-For ([#4595](atuinsh/atuin#4595)) ### [`v18.24.3`](https://github.com/atuinsh/atuin/blob/HEAD/CHANGELOG.md#18243) [Compare Source](atuinsh/atuin@v18.24.2...v18.24.3) ##### Bug Fixes - *(ai)* Parse history and output tool arguments with serde and reject unknown ones ([#4554](atuinsh/atuin#4554)) - *(client)* Keep the logging guard alive until the command finishes ([#4528](atuinsh/atuin#4528)) - *(daemon)* Build kv and scripts after a sync, not only history ([#4544](atuinsh/atuin#4544)) - *(daemon,sync)* Rebuild search index after `atuin sync` ([#4574](atuinsh/atuin#4574)) - *(deps)* Bump ctutils and tokio for RUSTSEC-2026-0385 and -0386 ([#4525](atuinsh/atuin#4525)) - *(deps)* Bump bandit to 1.14.0 and zstd to 0.14 for the open security advisories - *(deps)* Bump docs gitpython to 3.2.1 for GHSA-83vg-56qc-22m7 ([#4559](atuinsh/atuin#4559)) - *(deps)* Bump pulldown-cmark to 0.13.5 ([#4581](atuinsh/atuin#4581)) - *(docker)* Ship patched ca-certificates in the server image ([#4522](atuinsh/atuin#4522)) - *(i18n)* Say force *pull* in the store pull --force help ([#4523](atuinsh/atuin#4523)) - *(login)* Restart the daemon on the new key when login changes it ([#4555](atuinsh/atuin#4555)) - *(mcp)* Reject arguments a tool doesn't take instead of ignoring them ([#4553](atuinsh/atuin#4553)) - *(pty-proxy)* Don't auto-spawn on Linux virtual consoles ([#4564](atuinsh/atuin#4564)) - *(release)* Regenerate CONTRIBUTORS on every release ([#4561](atuinsh/atuin#4561)) - *(scripts)* Name the editor when launching it fails ([#4533](atuinsh/atuin#4533)) - *(server)* Check the password before deleting an account ([#4572](atuinsh/atuin#4572)) - *(sync)* Stop re-downloading history the server doesn't have - *(threads)* Stop reading claude code api-request blobs as messages ([#4538](atuinsh/atuin#4538)) - *(threads)* Keep opencode subagent prompts and other dropped content ([#4546](atuinsh/atuin#4546)) - *(threads)* Keep Claude Code recaps, safeguard notices, retried API errors and skill prompts ([#4547](atuinsh/atuin#4547)) - *(threads)* Keep omp python runs, file mentions, narration and subagent links ([#4548](atuinsh/atuin#4548)) - *(threads)* Keep codex subagent answers and voice transcripts, read compressed rollouts ([#4549](atuinsh/atuin#4549)) - *(threads)* Ignore enter_accept for resume ([#4573](atuinsh/atuin#4573)) - Undo i18n of `__internal` docs ([#4560](atuinsh/atuin#4560)) ##### Features - *(cli)* Categorized help via clap-couture ([#4384](atuinsh/atuin#4384)) - *(common)* Userio::log macros and sinks for user messages ([#4562](atuinsh/atuin#4562)) - *(dist)* Add a Windows MSI installer for atuin ([#4527](atuinsh/atuin#4527)) - *(mcp)* Install for all configured agents with `atuin mcp install` ([#4557](atuinsh/atuin#4557)) - *(search)* Add shell-up-key-binding keybinding condition ([#4552](atuinsh/atuin#4552)) - *(server)* Add admin commands to create, reset and delete users ([#4526](atuinsh/atuin#4526)) - *(threads)* Say how long writing the session file took before starting the harness ([#4537](atuinsh/atuin#4537)) - More correct numeric math ([#4585](atuinsh/atuin#4585)) ##### Miscellaneous Tasks - Skip nix build, illumos and package on mono's land/\* builds ([#4551](atuinsh/atuin#4551)) - Move the Windows jobs to Buildkite ([#4571](atuinsh/atuin#4571)) ##### Performance - Improve search index performance ([#4586](atuinsh/atuin#4586)) ##### Refactor - *(client)* Report a wrong encryption key through a typed error ([#4529](atuinsh/atuin#4529)) - *(deps)* Bump axoupdater from 0.10.0 to 0.10.3 ([#4539](atuinsh/atuin#4539)) - *(deps)* Bump futures-util from 0.3.33 to 0.3.34 ([#4540](atuinsh/atuin#4540)) - *(deps)* Bump serde_json from 1.0.151 to 1.0.154 ([#4541](atuinsh/atuin#4541)) - *(deps)* Bump tokio-util from 0.7.19 to 0.7.20 ([#4542](atuinsh/atuin#4542)) - *(deps)* Bump serde_with from 3.21.0 to 3.24.0 ([#4543](atuinsh/atuin#4543)) - *(pty-proxy)* Clean up tty ownership checks ([#4565](atuinsh/atuin#4565)) ##### Testing - *(secrets)* Remove the redaction timing tests ([#4566](atuinsh/atuin#4566)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2495

BinaryMuse marked this pull request as ready for review October 23, 2026 18:04

BinaryMuse requested review from ellie and markovejnovic October 23, 2026 18:04

BinaryMuse commented Oct 23, 2026

View reviewed changes

atuin-bot added mergebot:queued mergebot:running and removed mergebot:queued labels Oct 23, 2026

atuin-bot added the mergebot:merged label Oct 23, 2026

atuin-bot force-pushed the mkt/rustsec-2026-0385 branch from d2044b3 to 98fc62b Compare October 23, 2026 18:18

atuin-bot removed the mergebot:running label Oct 23, 2026

atuin-bot merged commit 98fc62b into main Oct 23, 2026
4 checks passed

atuin-bot deleted the mkt/rustsec-2026-0385 branch October 23, 2026 18:18

ellie mentioned this pull request Oct 29, 2026

chore(release): prepare for release 18.24.3 #4587

Merged

snoopy82481-bot Bot mentioned this pull request Oct 29, 2026

fix(container): update image ghcr.io/atuinsh/atuin (18.24.2 ➔ 18.24.3) snoopy82481/home-cluster#3950

Merged

1 task

ximikos mentioned this pull request Oct 29, 2026

Promote testing → main YunoHost-Apps/atuin_ynh#81

Merged

scottames-github-bot Bot mentioned this pull request Nov 2, 2026

chore(deps): update ⬆️ mise-packages scottames/dots#1140

Merged

1 task

Navigation Menu

Repository navigation

fix(deps): bump ctutils and tokio for RUSTSEC-2026-0385 and -0386 - #4525

fix(deps): bump ctutils and tokio for RUSTSEC-2026-0385 and -0386#4525
atuin-bot merged 1 commit into
mainfrom
mkt/rustsec-2026-0385

BinaryMuse commented Oct 23, 2026

Uh oh!

socket-security Bot commented Oct 23, 2026

Uh oh!

greptile-apps Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

BinaryMuse commented Oct 23, 2026

Uh oh!

BinaryMuse Oct 23, 2026 •

edited

Loading

Uh oh!

atuin-bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

BinaryMuse commented Oct 23, 2026

Uh oh!

socket-security Bot commented Oct 23, 2026

Uh oh!

greptile-apps Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

BinaryMuse commented Oct 23, 2026

Uh oh!

BinaryMuse Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

atuin-bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Oct 23, 2026 •

edited

Loading

BinaryMuse Oct 23, 2026 •

edited

Loading

atuin-bot commented Oct 23, 2026 •

edited

Loading