chore: bump rustls to 0.23.45 (RUSTSEC-2026-0285) - #33
Merged
Merged
Conversation
Addresses the medium TLS 1.3 handshake advisory by updating rustls 0.23.43 -> 0.23.45 and rustls-webpki 0.103.13 -> 0.103.15. cargo audit is clean of vulnerabilities after this bump. Amp-Thread-ID: https://ampcode.com/threads/T-01a0a633-11d2-7529-ae4c-9572c04b5518 Co-authored-by: Max Carter <undivisible@vk.com>
|
Capy couldn't review this pull request because Max's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_4e2f5074-5471-4729-85bd-8df66ac9a6e3) |
undivisible
added a commit
that referenced
this pull request
Sep 18, 2026
Addresses the medium TLS 1.3 handshake advisory by updating rustls 0.23.43 -> 0.23.45 and rustls-webpki 0.103.13 -> 0.103.15. cargo audit is clean of vulnerabilities after this bump. Amp-Thread-ID: https://ampcode.com/threads/T-01a0a633-11d2-7529-ae4c-9572c04b5518
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lockfile-only bump of
rustls0.23.43 → 0.23.45 (andrustls-webpki0.103.13 → 0.103.15) to close RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across encryption levels).cargo auditreports no remaining vulnerabilities. Yankedchacha20 0.10.1remains in the lockfile as a non-default-target transitive crate (not in the defaultcargo tree).Note
Low Risk
Lockfile-only dependency patch for a known TLS advisory; no code or API surface changes in this repo.
Overview
Updates
Cargo.lockonly to pull in patched TLS crates:rustls0.23.43→0.23.45and transitiverustls-webpki0.103.13→0.103.15, addressing RUSTSEC-2026-0285 (TLS 1.3 handshake messages incorrectly accepted across encryption levels). No application orCargo.tomlchanges.Reviewed by Cursor Bugbot for commit 978f605. Configure here.