From 0fd39a4ead57dfa72b79ab96123fd92c2c38367b Mon Sep 17 00:00:00 2001 From: al2wang Date: Wed, 14 Oct 2026 14:36:39 -0400 Subject: [PATCH] fix(deps): bump rustls to 0.23.46 for RUSTSEC-2026-0346..0349 `cargo deny check` now reports four advisories against rustls 0.23.45: `Debug` impls for client session values expose TLS secrets (0346), buffered application data sent to the outer server after ECH rejection (0347), Brotli certificate decompression can allocate up to 1 GiB before authentication (0348), and an unauthenticated ServerHello can downgrade later connections to classical key exchange (0349). All are fixed in >= 0.23.46. Lockfile-only change (rustls 0.23.45 -> 0.23.46); no other crate version moves. Signed-off-by: al2wang Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a8d2d65..01ae36b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3548,9 +3548,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "once_cell", "ring",