diff --git a/scripts/check-advisories.py b/scripts/check-advisories.py
index bbeab3ebb..a8d0634b6 100755
--- a/scripts/check-advisories.py
+++ b/scripts/check-advisories.py
@@ -27,9 +27,29 @@
 #     never pruned stops describing the tree and starts hiding it.
 #
 # Warnings (unmaintained, unsound, yanked) are counted and printed but do not
-# fail the run: they are advice about maintenance, not a reachable defect, and
-# gating on them would bury the vulnerabilities in noise. They are printed so
-# the number stays visible rather than unknown.
+# fail the run, and the count is printed so the number stays visible rather
+# than unknown. For `unmaintained` that is easy: it is advice about a crate's
+# future, not a reachable defect.
+#
+# `unsound` and `yanked` deserve a straighter answer, because neither is mere
+# maintenance advice and both have been worth acting on:
+#
+#   * unsound-with-a-fix is a real defect a bump would close — one of them was
+#     a use-after-free in `LruCache::pop()`. It is not gated **today** only
+#     because every current instance is either pinned by a dependent
+#     (zstd-safe under wasmtime 49's module cache, which nothing here
+#     configures) or needs a semver-major move of a transitive crate (lru,
+#     rand, glib). A gate that is red for things nobody can act on teaches
+#     people to bypass it, which costs more than it catches. Gate it once
+#     those can actually move.
+#   * yanked means the author withdrew a release, which can happen to a
+#     version that was correct when it was chosen: `crypto-bigint 0.7.6` was
+#     picked here to fix RUSTSEC-2026-0387 and was yanked afterwards, along
+#     with every 0.7.x below 0.7.9. Gating it would turn every PR red for a
+#     decision made outside the tree, so it stays a warning — but it is worth
+#     re-reading after any advisory work, which is how that one was caught.
+#
+# Both are therefore a standing review item, not an oversight.
 #
 #   check-advisories.py                  every tracked Cargo.lock, less SKIP
 #   check-advisories.py DIR ...          exactly these directories
diff --git a/smart-byte/smart-byte-rs/Cargo.lock b/smart-byte/smart-byte-rs/Cargo.lock
index f85aa68cb..9a37b24bd 100644
--- a/smart-byte/smart-byte-rs/Cargo.lock
+++ b/smart-byte/smart-byte-rs/Cargo.lock
@@ -857,9 +857,9 @@ dependencies = [
 
 [[package]]
 name = "cmov"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
 [[package]]
 name = "cobs"
@@ -1045,9 +1045,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "crypto-bigint"
-version = "0.7.6"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0"
+checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11"
 dependencies = [
  "cpubits",
  "ctutils",
@@ -1090,9 +1090,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.5"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
+checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
 dependencies = [
  "cmov",
  "subtle",
@@ -1218,7 +1218,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 2.0.117",
+ "syn 1.0.109",
 ]
 
 [[package]]