[mike1858]

Why

cargo audit is a required status check, and it now fails on every PR (for example #280) regardless of its diff. The RustSec advisory database published four advisories against rustls 0.23.45 on 2026-10-14, and Splitrail's lockfile pins exactly that version:

Advisory	Title
RUSTSEC-2026-0346	Debug impls for client session values expose TLS secrets
RUSTSEC-2026-0347	Buffered application data sent to outer server after ECH rejection
RUSTSEC-2026-0348	Brotli certificate decompression can allocate up to 1 GiB before authentication
RUSTSEC-2026-0349	Unauthenticated ServerHello can downgrade later connections to classical key exchange

All four list >=0.23.46 as the solution. rustls is on Splitrail's real network path (reqwest → hyper-rustls/tokio-rustls for the cloud upload client), so this is not one of the feature-gated false positives documented in .cargo/audit.toml. Until this lands, no release PR can pass checks.

What changed

A lockfile-only bump via cargo update -p rustls --precise 0.23.46. Cargo.toml is untouched.

Crate	Before	After
rustls	0.23.45	0.23.46

No other crate moved. Unlike #262, this patch release needs no aws-lc-rs/aws-lc-sys bump, so the C crypto backend and its cross-compilation surface are unchanged.

Not changed

The two unsoundness warnings that cargo audit reports without failing are still left alone, as in #262:

• RUSTSEC-2026-0190 (anyhow, Error::downcast_mut())
• RUSTSEC-2026-0253 (lru, LruCache::pop() panic safety)

Validation

• cargo audit → exit 0 (was: error: 4 vulnerabilities found!)
• cargo build --quiet
• cargo test --quiet (500 passed)
• cargo clippy --quiet -- -D warnings
• cargo fmt --all --check

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fcc530bf-5bba-47e7-9252-7eec11e24e56

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}