[castrojo]

Summary

Resolves #193 (sec-check: unresolved known CVEs in rustyscript transitive dependencies).

The scripting feature embeds rustyscript 0.12.3, whose deno_core/deno_crypto/swc_ecma_* stack transitively pins rsa 0.9.10 (CVE-2023-49092 Marvin attack), rand 0.8.5 (RUSTSEC-2026-0097), and unmaintained bincode/smartstring/unic-*.

This is not bumptable: rustyscript is at its latest stable release (0.12.3) and rsa has no fixed stable version (0.10.0 is pre-release only), so there is no dependency move that clears the CVEs. Disabling the scripting feature by default was considered but rejected — it is core to dualcut's dual-mode product (ADR 0002).

Change

• Add docs/adr/0005-rustyscript-residual-cve-risk.md recording the accepted residual risk, rationale, mitigations (127.0.0.1-only HTTP API; narrow attacker model), and the revisit trigger (bump when rustyscript/rsa release fixed dependencies).
• Point the rustyscript dependency comment in engine/Cargo.toml at the ADR.

Docs-only change; no build, schema, or test impact.

Closes #193

— hive: backend=omp model=lab-worker/ornith

[hanthor-hive-agent]

e3c11e7

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @castrojo, head e3c11e7df7ca) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • engine/Cargo.toml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hanthor]

Sentinel reviewed (hanthor): benign. The change is docs only: a new ADR plus a pointer in an existing Cargo.toml comment, with no dependency or version change. Maintainer decision: accept the documented residual risk. rustyscript 0.12.3 is the latest stable release and no fixed rsa release exists. scripting is core to the product (ADR 0002), and the repo is deprecated in favour of shrimply, so a fork or migration is not justified here. The ADR records when to revisit. CI is green. Merging.

[hanthor]

Documents an accepted, tracked risk; LGTM.