Repository navigation
fix(deps): take rustls 0.23.46 for four new advisories - #447
Merged
Merged
Conversation
RUSTSEC-2026-0346, -0347, -0348 and -0349 were published against rustls 0.23.45 after `main`'s last CI run, so its green badge was stale: the lockfile fails `cargo deny check advisories` today, and every open pull request fails the same required check for the same reason. None of the four reaches this build, and each was checked against source rather than the advisory title: - -0346 needs a custom ClientSessionStore that Debug-formats session values. Neither this project nor ureq 3.3.0 installs one. - -0347 needs a client configured for Encrypted Client Hello. Nothing here configures ECH and no enabled ureq feature turns it on. - -0348 needs rustls' non-default `brotli` feature, which is not enabled. - -0349 downgrades a client offering X25519MLKEM768. This build links the `ring` provider, which offers classical groups only; aws-lc-rs is not in the dependency graph. Taken anyway, because the advisories fail the required `cargo-deny` gate and a lockfile audit would flag the old release. Lockfile only, one package. Verified: `cargo deny check advisories` reports all four IDs on the old lockfile and `advisories ok, bans ok, licenses ok, sources ok` on the new one. Records F394: the ureq comment in codelore-lib's Cargo.toml names aws-lc-rs as the TLS backend, which would make -0349 look reachable when it is not. Claude-Session: https://claude.ai/code/session_01LRZ8yoFPCFgfZ8raBUeDeP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainis red again for the same reason as #445: advisories published after itslast CI run. Four new rustls advisories land against 0.23.45, and since
cargo-denyis a required check they blockmainand every open PR —including #446, which this unblocks.
main's last CI run (2026-10-14 03:04) predates them, so its green badge isstale. Verified locally: main's lockfile fails
cargo deny check advisorieswith all four IDs.
None of the four reaches this build
Checked against source, not the advisory titles:
Debugleaks TLS secretsClientSessionStorethatDebug-formats valuesbrotlifeatureX25519MLKEM768ringprovider, classical groups only; aws-lc-rs is not in the graphTaken anyway: the advisories fail the required gate, and a lockfile audit would
flag the old release.
Change
Lockfile only —
rustls0.23.45 → 0.23.46, one package. A### SecurityCHANGELOG entry states the reach accurately rather than implying exposure.
Verification
cargo deny check advisoriesreports all four IDs on the old lockfile andadvisories ok, bans ok, licenses ok, sources okon the new one.machine); CI runs the full suite.
Ledger
F394 — the
ureqcomment incrates/codelore-lib/Cargo.tomlsays TLS goesthrough aws-lc-rs. It goes through
ring. That matters beyond tidiness: underaws-lc-rs, -0349 would be reachable, so a security note written from the
comment would be wrong in the alarming direction. Recorded, not fixed inline.
https://claude.ai/code/session_01LRZ8yoFPCFgfZ8raBUeDeP