chore(deps): sync the events lockfile, bump rustls for RUSTSEC-2026-0285 - #320
Merged
Merged
Conversation
senzenn
marked this pull request as ready for review
September 13, 2026 12:08
`tests/proc-macro-events` is a separate workspace, so the version bump in #316 did not reach its lockfile. It still pins the 13 in-repo `shipstern-*` crates at `0.9.0`, and running `cargo test --manifest-path tests/proc-macro-events/Cargo.toml` rewrites them, leaving a dirty tree after a clean checkout. The root lockfile moves rustls 0.23.44 to 0.23.45 in the same commit. 0.23.44 is RUSTSEC-2026-0285: it accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record, which RFC 8446 section 5.1 requires be rejected. The transcript is still authenticated, so a network-position attacker cannot alter or complete a handshake with it, but `cargo deny check advisories` treats it as a vulnerability and that gate runs in the fmt job on every PR. Nothing in this stack caused it. The same check fails on an untouched origin/main, and the green tick this branch was carrying predates the advisory rather than surviving it. rustls is already declared `rustls = "^0.23"` in the root manifest, so the caret absorbs the patch and only the lockfile moves: four lines.
senzenn
force-pushed
the
fix/proc-macro-events-lockfile
branch
from
September 14, 2026 18:04
6b3e68c to
dd0e333
Compare
senzenn
changed the title
kespinola
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tests/proc-macro-events is a separate workspace, so the version bump in #316 did not
reach its lockfile. It still pins the 13 in-repo shipstern-* crates at 0.9.0, and running
cargo test against that manifest rewrites them, leaving a dirty tree after a clean
checkout. CI does not pass --locked so it is not a hard failure, but the file is a cache
key in ci.yml, which the stale copy makes wrong.
13 packages, version field only. Nothing added, removed or upgraded.
The root lockfile also moves rustls 0.23.44 to 0.23.45. 0.23.44 is RUSTSEC-2026-0285: it
accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed
a key-changing message in the same record, which RFC 8446 section 5.1 requires be
rejected. The handshake transcript is still authenticated, so a network-position attacker
cannot use it to alter or complete a handshake, but cargo deny check advisories treats it
as a vulnerability and that gate runs in the fmt job on every PR.
That failure does not come from this branch. The same check fails on an untouched
origin/main, and the green tick this PR was carrying predates the advisory rather than
surviving it. rustls is already declared rustls = "^0.23" in the root manifest, so the
caret absorbs the patch and only the lockfile moves: four lines.
It stays its own PR because two stacks need the lockfile sync, and because the advisory
bump is easier to review on its own than buried inside a codama migration.
Tested: cargo test --tests --manifest-path tests/proc-macro-events/Cargo.toml passes and
the tree stays clean afterwards. cargo deny check advisories goes from FAILED to ok.