fix(security): upgrade rustls stack to 0.23 — clear RUSTSEC-2026-0098/-0099/-0104 - #432
Closed
MattJackson wants to merge 2 commits into
Closed
fix(security): upgrade rustls stack to 0.23 — clear RUSTSEC-2026-0098/-0099/-0104#432MattJackson wants to merge 2 commits into
MattJackson wants to merge 2 commits into
Conversation
Upgrade tokio-rustls to 0.26, rustls to 0.23, and rustls-native-certs to 0.8 to resolve RUSTSEC-2024-0421 and RUSTSEC-2025-0010. Migrate the TLS stream to the rustls 0.23 API. Switch the crypto provider to aws-lc-rs via builder_with_provider to avoid the dual-provider conflict that tokio-rustls 0.26 introduces when ring is also in the dependency graph. Pin to TLS 1.2 to prevent TLS 1.3 KeyUpdate messages from triggering UnexpectedEof on the macOS CI runner. (cherry picked from commit d46e4c0)
azure_core 0.20.0 switched from reqwest 0.11 to reqwest 0.12, which pulls in rustls 0.23 and rustls-webpki 0.103.13. Bumping azure_identity to 0.20.0 closes RUSTSEC-2026-0098, 0099, and 0104 in the dev build without any changes to the production stack. client_credentials_flow::perform now takes &str for the client secret. Updated aad-auth.rs to pass raw env var strings and dropped the oauth2 ClientId/ClientSecret wrappers. Also bump reqwest 0.11 -> 0.12 and oauth2 4.2.3 -> 5.0 in dev-dependencies to match. Remove .cargo/audit.toml - the suppressions are no longer needed. (cherry picked from commit 0e90db7)
This was referenced Sep 1, 2026
Closed
Open
Contributor
Author
|
Superseded by #439. Re-opened as a native GitHub stacked PR (stack #445) per @aqrln's request in #440 — the fork origin of these PRs made a native stack impossible (GitHub can't add fork-head PRs to a stack), so the branches now live in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the three rustls certificate-verification advisories. Both commits are @jakewimmer's work (mirrors #419), authorship preserved.
tokio-rustls0.24→0.26 (rustls 0.21→0.23),rustls-native-certs0.6→0.8 → pulls inrustls-webpki0.103.x.ServerCertVerifier(verify_tls13_signature,supported_verify_schemes),Certificate→CertificateDer,aws-lc-rscrypto provider; TLS-only items gated so--no-default-featuresbuilds stay clean.azure_identity0.5.0→0.20.0 (aad-auth example).Non-breaking — no public API changes. Safe for a patch release, no major bump. Verified: builds clean (default / rustls /
--features all),cargo auditconfirms RUSTSEC-2026-0098/-0099/-0104 cleared.Supersedes #419 — same fix, credit to @jakewimmer.
Out of scope (separate follow-up):
azure_core(RUSTSEC-2026-0275, dev-dep) andrkyv(RUSTSEC-2026-0235, transitive under optionalrust_decimal).Reviewer note: please rebase-merge or merge-commit, not squash — this PR carries @jakewimmer's commits with authorship intact; squashing would collapse that credit.