chore(deps): upgrade rustls stack to 0.23 - #1
Merged
Conversation
Upgrade tokio-rustls to 0.26, rustls to 0.23, and rustls-native-certs to 0.8 to resolve RUSTSEC-2024-0421 and RUSTSEC-2025-0010. Migrate the TLS stream to the rustls 0.23 API. Switch the crypto provider to aws-lc-rs via builder_with_provider to avoid the dual-provider conflict that tokio-rustls 0.26 introduces when ring is also in the dependency graph. Pin to TLS 1.2 to prevent TLS 1.3 KeyUpdate messages from triggering UnexpectedEof on the macOS CI runner.
phillipleblanc
changed the title
There was a problem hiding this comment.
Pull request overview
Upgrades the crate’s Rustls/Tokio-Rustls TLS stack to the Rustls 0.23 API surface (via tokio-rustls 0.26), aligning this fork with upstream’s security/compatibility fixes while keeping the change scoped to TLS-related updates.
Changes:
- Bumps TLS dependencies and removes
rustls-pemfilefrom therustlsfeature set. - Ports the rustls TLS stream implementation to the rustls 0.23 API, selecting the
aws-lc-rsprovider and pinning TLS 1.2. - Adds
cargo-auditconfiguration to ignore specific dev-dependency-only advisories.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
src/tds/codec/header.rs |
Adds TLS-feature gating around PacketHeader::set_type to match where it’s used. |
src/client/tls.rs |
Adds TLS-feature gating around imports/types used only during TLS handshake packet wrapping. |
src/client/tls_stream/rustls_tls_stream.rs |
Migrates Rustls stream implementation to rustls 0.23 types/APIs and aws-lc provider; updates certificate loading/parsing paths. |
examples/aad-auth.rs |
Adjusts the AAD auth example to use raw env var strings and minor string handling updates. |
Cargo.toml |
Updates TLS dependency versions and removes rustls-pemfile from the rustls feature. |
.cargo/audit.toml |
Introduces audit ignore configuration for specified advisories (documented as dev-dependency-only). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
peasee
approved these changes
Jun 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrade rustls stack to 0.23 (port of tiberius-rs#419)
Cherry-picks the rustls-upgrade commit from upstream prisma/tiberius#419 onto the
spiceaibranch:tokio-rustls0.24→0.26,rustls→0.23,rustls-native-certs0.6→0.8; dropsrustls-pemfilebuilder_with_provider(avoids the dual-provider conflict tokio-rustls 0.26 hits whenringis also in the graph)UnexpectedEofon macOS CIWhy we need this
Tiberius 0.12.3 pins
tokio-rustls 0.24→rustls 0.21→rustls-webpki 0.101.7, which keeps the patchedrustls-webpki 0.103.13from being the only copy downstream (GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, plus the LOW name-constraint advisories). Upstream tiberius has no rustls-0.23 release, so we carry the fix on this fork'sspiceaibranch until it lands upstream.Validation
cargo check --no-default-features --features tds73,rustls,chrono(the exact feature set the consumer enables) passes; the resolved tree now usestokio-rustls 0.26.4andrustls-webpki 0.103.13— norustls 0.21/rustls-webpki 0.101.7.