Update rustls and h2 past their advisories

[btsouth]

Two advisories in Cargo.lock, both with a patched version available.

rustls 0.23.39 to 0.23.45 (RUSTSEC-2026-0285, CVSS 5.3)

Rustls accepted TLS 1.3 handshake messages at the wrong encryption level when they followed a key-changing message in the same record, so a peer could send handshake messages that should have been encrypted in plaintext without the connection being rejected. Patched in >= 0.23.45.

Reachable in the shipped build. cargo tree --target x86_64-pc-windows-msvc -i rustls:

rustls v0.23.45
├── hyper-rustls v0.27.9
│   └── reqwest v0.12.28
│       └── codexbar v1.5.38 (rust)
│           └── codexbar-desktop-tauri v1.5.38 (apps/desktop-tauri/src-tauri)
├── reqwest v0.12.28 (*)
└── tokio-rustls v0.26.4

Same shape on aarch64-pc-windows-msvc.

h2 0.4.13 to 0.4.19 (RUSTSEC-2026-0258)

Unbounded empty DATA frames, patched in >= 0.4.16. Reached through hyper 1.9.0, which reqwest, hyper-util, hyper-rustls and mockito pull in. Worth being precise about this one: unlike rustls it is not in the Windows dependency graph (cargo tree --target <windows> | grep h2 is empty), it rides in the lockfile through hyper's optional h2 dependency. It is one command to keep clean and it becomes reachable the day that feature is enabled.

Change

Cargo.lock only. Three package versions move, no manifest change:

• rustls 0.23.39 to 0.23.45
• rustls-webpki 0.103.13 to 0.103.15 (follows rustls)
• h2 0.4.13 to 0.4.19

Commands run

cargo audit --file Cargo.lock      before: exit 1, 2 vulnerabilities found
                                   after:  exit 0, warning: 11 allowed warnings
cargo metadata --locked            consistent
cargo tree --locked --target x86_64-pc-windows-msvc -i rustls   reachable, as above

I did not finish a cross-target cargo check locally (the whole filesystem is out of btrfs unallocated space and the build tripped ENOSPC), so compile and test coverage for this lands on the Rust / shared and Rust / desktop jobs in CI.

Follow-up worth considering

This repo's CI has no Rust advisory step at all, which is why both of these sat invisible while main stayed green. A cargo audit step in the Rust / shared job would have caught them. There are currently 11 advisories that would report as warnings rather than failures (fxhash, proc-macro-error, the unic-* set, event-listener, glib, rand 0.7), so a gate would need a decision about which of those to waive. Say the word and I will open it as a separate change.

Note

Update rustls and h2 past security advisories in Cargo.lock

Bumps rustls and h2 to versions beyond their advisory thresholds. Only the lockfile is touched.

^{Macroscope summarized 1941bb8.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 46d9d6c4-813a-4533-a763-42f4950300ea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ceiling	1941bb8	Commit Preview URL Branch Preview URL	Sep 18 2026, 12:33 AM