Repository navigation
chore(deps): update rustls to 0.23.46 - #2141
Merged
Merged
Conversation
Picks up the fix release for the four rustls advisories published 2026-10-14: - RUSTSEC-2026-0346: Debug impls for client session values exposed TLS secrets - RUSTSEC-2026-0347: buffered application data sent to the outer server after an ECH rejection - RUSTSEC-2026-0348: brotli certificate decompression could allocate up to 1 GiB before authentication - RUSTSEC-2026-0349: unauthenticated ServerHello could downgrade later connections to classical key exchange All four are patched by 0.23.46; the publisher is already trusted, so no audit changes are needed. Also refreshes the vet imports lock (publisher entry for rustls, upstream import URL migration). This unblocks the static checks job, which fails on every branch since the advisory database picked up the new entries.
nullPointerEnjoyer
requested review from
ImplOfAnImpl,
anyxem and
erubboli
as code owners
October 15, 2026 20:22
|
✅ OpenCodeReview: Review skipped: no items were selected. |
erubboli
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cargo.lock-only bump of
rustls0.23.45 → 0.23.46, the fix release for four advisories published 2026-10-14:Debugimpls for client session values expose TLS secretsWhy now
The advisory database refreshed on 2026-10-15, so the
static_checksjob (cargo-deny advisories step) fails on every branch, includingmasteritself (first red run: 2026-10-15 04:43 UTC oncd64edf91, which passed the day before) and all open PRs. This restores a green baseline; open PRs will re-run against it after merge.Notes
cargo checkgreen, full gate green (fmt, cargo-deny, cargo-vet, codecheck, clippy).rustlspublisher entry moves to 0.23.46 (published byctz, user-id 2751 — an already-trusted publisher, so no new audit entries), plus the upstream Mozilla import URL migration (hg.mozilla.org→mozilla-firefox/firefoxon GitHub).