From aa11f6a94265c98f94651cfa6ef12ef167d169a0 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Mon, 14 Sep 2026 14:43:40 -0400 Subject: [PATCH] fix(deps): rustls 0.23.41 -> 0.23.45 for RUSTSEC-2026-0285 TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries (GHSA-2mjx-qc3c-rqvc). Advisory published 2026-09-14; patched in >= 0.23.45. main is affected as of today. cargo update -p rustls --precise 0.23.45. Verified cargo metadata --locked resolves with no further change. Found by sweeping every Cargo.lock on every nself-org default branch after this advisory blocked a clawde PR: nchat, nclaw, ntask and clawde were all affected; plugins-pro was already on 0.23.45. --- apps/desktop/src-tauri/Cargo.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock index d8c9436..ac0cf06 100644 --- a/apps/desktop/src-tauri/Cargo.lock +++ b/apps/desktop/src-tauri/Cargo.lock @@ -2367,7 +2367,7 @@ dependencies = [ [[package]] name = "ntask-desktop" -version = "1.3.1" +version = "1.4.0" dependencies = [ "anyhow", "chrono", @@ -3301,9 +3301,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.41" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -3363,9 +3363,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",