Repository navigation
chore(deps): rustls 0.23.46 on release/0.7.0 (RUSTSEC-2026-0346, -0347, -0348, -0349) - #2210
Conversation
…2206) Four rustls advisories published 2026-10-14 against 0.23.45 (Debug impls exposing TLS secrets, buffered data after ECH rejection, brotli certificate decompression before authentication, ServerHello downgrade). Lockfile-only: 0.23.46 is the patched release. cargo-deny is red on main and on every PR until this lands. (cherry picked from commit 598e6d8)
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Approved: no findings at Nothing to do. Clobber: none: the base on this branch pinned 0.23.45 and the prior commits are unrelated release-candidate declarations; no recent fix is reverted. Consistency verified structurally: exactly one |
There was a problem hiding this comment.
correctness
minimal-review — approved
Verdict APPROVE — No findings.
security
minimal-review — approved
Verdict APPROVE — No findings.
supply-chain
minimal-review — approved
Verdict APPROVE — No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
Cherry-pick of #2206 onto
release/0.7.0.release/0.7.0ships rustls 0.23.45, which four advisories published 2026-10-14 affect:Debugimpls exposing TLS secrets (RUSTSEC-2026-0346), buffered application data sent after an ECH rejection (-0347), brotli certificate decompression allocating before authentication (-0348), and an unauthenticated ServerHello downgrading later connections (-0349). 0.23.46 fixes all four. The change is the lockfile bump and nothing else.Without it, cargo-deny is red on the release branch, so 0.7.0 cannot be cut from it.
Verification
just denyon this branch (macOS):advisories ok, bans ok, licenses ok, sources ok.Cargo.lockis the only file changed.