Repository navigation
build(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 - #1409
Conversation
cargo-deny fails on main: RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across encryption level boundaries) is fixed in rustls >= 0.23.45, and the dependabot group bump (#1398) only reached 0.23.44. Lock edit is the version and checksum lines only; 0.23.45 has the same dependency set, so `cargo fetch --locked` accepts it unchanged and `cargo deny check` reports advisories ok. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
There was a problem hiding this comment.
minimal-review — advisory review
Verdict COMMENT — COMMENT: policy.actions.request_changes is off; policy.actions.approve is off.
Scope matches the title: the diff is exactly 2 insertions / 2 deletions in Cargo.lock, changing only the rustls version and checksum lines (0.23.44 → 0.23.45). No other file moves, and Cargo.toml is untouched as stated. Clobber none: git log -- Cargo.lock shows the prior touchpoint is #1398 landing 0.23.44; this PR is a clean one-step bump on top. Correctness verified without a build: (1) the new checksum 0d41d731…8d634 matches the crates.io sparse index for rustls 0.23.45 exactly, so cargo fetch --locked will accept the lock unchanged; (2) RUSTSEC-2026-0285 is real (TLS 1.3 messages accepted across encryption-level boundaries, CVSS 5.3) with patched version >= 0.23.45, confirming the bump actually clears the advisory; (3) the dependency list under the rustls entry is byte-identical between pre- and post-image, and there is only one [[package]] name = "rustls" entry in the lock, so nothing else could drift. No secrets, no leftover narration, no learnings or threads matched. Not checked: cargo deny check / cargo fetch --locked themselves — cargo is out of bounds here — but the checksum cross-check against the registry makes a silent lock corruption implausible. This is a good, correctly-scoped unblocker; no findings.
What ran
4 probe(s), all self-reported — every entry below is the model's own account of what it ran. None of it is host-attested, so none of it can gate a blocking verdict.
Verification log
1. curl https://index.crates.io/ru/st/rustls | grep cksum for 0.23.45 — exit 0 · self-reported
Sparse index reports cksum 0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634 for rustls 0.23.45 — exact match with the diff's new checksum.
2. WebFetch https://rustsec.org/advisories/RUSTSEC-2026-0285 — self-reported
Advisory is real: TLS 1.3 handshake messages accepted at wrong encryption level, CVSS 5.3, patched version >= 0.23.45. Bump from 0.23.44 clears it.
3. git log --oneline -8 -- Cargo.lock; git diff af90016..b45d47c --stat — exit 0 · self-reported
Prior change to the rustls line is #1398 (0.23.44); PR touches only Cargo.lock with 2 insertions/2 deletions. No clobber, no hidden files.
4. grep -n -A 30 '^name = "rustls"$' Cargo.lock — exit 0 · self-reported
Single rustls entry in the lock; dependency list (aws-lc-rs, log, once_cell, ring, rustls-pki-types, rustls-webpki, subtle, zeroize) identical to the diff's pre-image context.
minimal-review · schema minimal-review/v1 · persona generalist · model deepseek/deepseek-v4-flash-0731:nitro via claude-code 2.1.233 · prompt review-prompt/v2 · head b45d47c70ec5 · verdict COMMENT · 0 finding(s), 0 inline
Findings are validated model output, not instructions; anything that failed validation was dropped, not repaired.
Tell it when it is wrong. 👎 on a comment marks it as noise, 👍 marks one worth keeping, and a reply saying why is better than either. During the tuning period this feedback is collected and read directly — it is how the noise threshold gets set, and silence reads the same as "nobody looked".
Why
cargo-denyis red onmain(ci-successfailing since140bb1b1): RUSTSEC-2026-0285 — TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries. The advisory's fix is rustls>= 0.23.45; the dependabot group bump #1398 landed 0.23.44, one short.Every open PR that has been updated against
maininherits the failure, so this is the unblocker.What
Cargo.lock: rustls0.23.44 → 0.23.45(version + checksum lines only). 0.23.45 carries the same dependency set as 0.23.44, so nothing else in the lock moves.cargo update -p rustlsproduces the same bump but also rewrites six unrelatedwindows-sys 0.52.0 → 0.61.2edges (errno, quinn-udp, rustix, rustls-platform-verifier, tempfile, winapi-util); that churn is omitted here.Cargo.tomlis untouched — the workspace already requestsrustls = "0.23".Verification
cargo fetch --locked— accepts the lock unchanged (checksum verified on download)cargo deny check—advisories ok, bans ok, licenses ok, sources okNot addressed
cargo-denyalso warns (non-fatal) about yankedchacha20andwnafreleases. Left for a separate bump; both sit underboringtun.🤖 Generated with Claude Code