From 11c1350d8984f6a07de65bc828a9d8d5b3213b90 Mon Sep 17 00:00:00 2001
From: Elijah Zupancic <elijah@zupancic.name>
Date: Mon, 14 Sep 2026 10:10:27 -0700
Subject: [PATCH] fix(deps): clear RUSTSEC-2026-0285 by bumping rustls to
 0.23.45
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `cargo-deny` job has been red on `main` since 78a11ecb, and on PR
#1459, for one reason: `advisories FAILED` against `rustls 0.23.43`.
Every other job in both runs passed, so the failure is not attributable
to either change — the advisory was published against a version the
lockfile already carried, which is why a dependency-free commit turned
CI red.

RUSTSEC-2026-0285: rustls accepted TLS 1.3 handshake messages sent at
the wrong encryption level when they followed a key-changing message in
the same record — a plaintext `EncryptedExtensions` packed into the
`ServerHello` record, for example — where RFC 8446 section 5.1 requires
the connection be terminated with an `unexpected_message` alert. The
handshake transcript remains authenticated, so a network-position
attacker can neither alter nor complete a handshake; the practical
effect is that a peer may send in plaintext handshake messages that
should have been encrypted without rustls rejecting the connection.
Functionally the same bug as Go's GO-2026-4340 (CVE-2025-61730).

`rustls` reaches this workspace only as a dev-only transitive
dependency (`jsonschema` -> `reqwest` -> `hyper-rustls` /
`tokio-rustls` / `rustls-platform-verifier`), so no shipped code path
negotiates TLS through it and no published crate's dependency graph
changes. The fix is therefore a lockfile bump to the advisory's minimum
fixed release, 0.23.45.

The diff is deliberately two lines. `cargo update -p rustls` also
re-resolved `tempfile`'s `getrandom` edge from `0.4.3` to `0.3.4` —
incidental churn, since `tempfile 3.27.0` requires `>=0.3.0, <0.5` and
both versions remain in the lock through other dependents. That hunk is
reverted; `cargo metadata --locked` accepts the result without
re-resolving, so the minimal lockfile is stable rather than something
the next cargo invocation would churn back.

No pinning test accompanies this, unlike `h2`/RUSTSEC-2026-0258 in
`big-code-analysis-web/src/lockfile_tests.rs`. That test exists because
krates filters `h2 0.3.27` out of the graph before cargo-deny's checks
run, leaving the advisory gate blind. `rustls` is in the graph and the
gate saw it — a second guard over the same lockfile line would be
redundant with a check that already works.

Verified: `cargo deny --log-level warn --manifest-path ./Cargo.toml
--all-features check advisories bans licenses sources` (CI's exact
invocation) exits 0 with `advisories ok, bans ok, licenses ok, sources
ok`; `make pre-commit` reports `BCA_GATE: pass (gate=pre-commit)`.
---
 CHANGELOG.md | 14 ++++++++++++++
 Cargo.lock   |  4 ++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 016a5519..9da18865 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -717,6 +717,20 @@ for historical reference.
   was reported at 7 — a finding the CLI never emits — and
   closure-heavy code drew spurious SARIF findings.
 
+### Security
+
+- Cleared RUSTSEC-2026-0285 by moving `rustls` `0.23.43` → `0.23.45` in
+  the workspace lockfile. Rustls accepted TLS 1.3 handshake messages
+  sent at the wrong encryption level when they followed a key-changing
+  message in the same record — for example a plaintext
+  `EncryptedExtensions` packed into the `ServerHello` record — where
+  RFC 8446 §5.1 requires the connection be terminated with an
+  `unexpected_message` alert. The handshake transcript stays
+  authenticated, so a network-position attacker cannot alter or
+  complete a handshake. `rustls` is a dev-only transitive dependency
+  here (`jsonschema` → `reqwest`), reached by no shipped code path;
+  the bump keeps the `cargo-deny` advisories gate green.
+
 ## [2.2.0] - 2026-08-29
 
 One entry below is marked **(breaking)**: the Python bindings'
diff --git a/Cargo.lock b/Cargo.lock
index 62baace5..e309c9df 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3691,9 +3691,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.43"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "aws-lc-rs",
  "once_cell",