fix(deps): take rustls 0.23.46 for four new advisories

CHANGELOG.md

@@ -8,6 +8,8 @@ Conventional Commits format. All notable changes documented here.
 
 - **rustls accepted TLS 1.3 handshake messages across encryption-level boundaries (RUSTSEC-2026-0285).** RFC 8446 §5.1 requires that a handshake message not span a key change and that an implementation terminate the connection with an `unexpected_message` alert when one does; rustls before 0.23.45 did not, so a peer could send in plaintext handshake messages that belong after the key change and rustls would accept rather than reject the connection. The handshake transcript stays authenticated, so a network-position attacker cannot use this to alter or complete a handshake — the defect is conformance, not authentication, and it is the same bug as Go's CVE-2025-61730. It reaches this project through `ureq`, which is both a runtime dependency — the advisory enrichment layer's HTTPS client in `enrichment/client.rs` is its only caller, so the exposure is limited to runs that opt into narratives and talk to a model endpoint — and a build dependency, where `build.rs` fetches the SPA's vendored JavaScript over TLS against pinned SHAs under the `spa` feature that released binaries enable. The pinning is what bounds the build-time half: a fetch that returned altered bytes fails the digest check rather than being embedded. Resolved in the lockfile alone, `rustls` 0.23.40 → 0.23.45 and `rustls-webpki` 0.103.13 → 0.103.15, with no manifest change, because the fix is a patch release within the range already requested. Present in released builds.
 
+- **Four further rustls advisories (RUSTSEC-2026-0346, -0347, -0348 and -0349), none of them reachable in this build.** Each has a precondition the TLS stack here does not meet. -0346 discloses the TLS 1.2 master secret or TLS 1.3 resumption PSK only through a custom `ClientSessionStore` that `Debug`-formats session values, and neither this project nor `ureq` installs one — the default in-memory cache is used. -0347 sends buffered application data to the outer server after an Encrypted Client Hello rejection, and nothing here configures ECH. -0348 lets a peer force a 1 GiB allocation through Brotli certificate decompression, which needs rustls' non-default `brotli` feature, not enabled here. -0349 lets an unauthenticated ServerHello downgrade later connections from the post-quantum `X25519MLKEM768` group to classical X25519, and the `ring` provider this build links offers classical groups only, so there is no post-quantum group to lose. Taken anyway, because `cargo deny` fails the build on any of them and an audit of the lockfile would flag the old release. Lockfile only: `rustls` 0.23.45 → 0.23.46.
+
 ## [0.30.0] - 2026-09-09
 
 ### Added

docs/reports/deep_analysis_report.md

@@ -4599,4 +4599,26 @@ next has reason to open either file.
 Found while checking whether the new path-containment helper duplicated an
 existing one; it does not, but this pair does.
 
-The next sweep re-opens at **F394**.
+### F394 (Active) — a dependency comment names a TLS backend the build does not contain
+
+The `[build-dependencies]` note on `ureq` in `crates/codelore-lib/Cargo.toml`
+says its default features give "TLS via rustls' aws-lc-rs backend". aws-lc-rs
+is not in the dependency graph at all: `cargo tree -i aws-lc-rs` matches
+nothing, `ureq` resolves to its `_ring` / `rustls-no-provider` features, and
+rustls is built with `ring`.
+
+The cost is not cosmetic, because the backend decides which TLS advisories
+reach this build. aws-lc-rs offers the post-quantum `X25519MLKEM768` group by
+default and `ring` offers classical groups only, so RUSTSEC-2026-0349 — a
+downgrade *from* that group — reads as reachable to anyone who trusts the
+comment, and is in fact unreachable. A security note written from the comment
+would be wrong, in the alarming direction, and would send someone looking for
+an exposure that does not exist.
+
+The fix is a one-line correction to the comment. It is recorded rather than
+applied because the change that surfaced it is a lockfile bump.
+
+Found while establishing which of the 2026-10 rustls advisories reach this
+build.
+
+The next sweep re-opens at **F395**.