fix(deps): rustls 0.23.45 for RUSTSEC-2026-0285 - #50
Conversation
A TLS 1.3 handshake advisory published today, between 15:44 and 16:17 UTC. It
turned `Cargo Audit` red on a branch whose `Cargo.lock` had not changed at all,
which is the tell: the advisory database moved, not this repository.
RUSTSEC-2026-0285, severity 5.3
TLS 1.3 handshake messages incorrectly accepted across encryption
level boundaries — plaintext handshake messages in the same record as
an encryption-level change were accepted instead of terminating the
connection.
affected 0.23.13 ..= 0.23.44 patched >= 0.23.45 we were on 0.23.37
`main` is affected too and does not know it yet: its last CI run was 10:47 UTC,
before the advisory existed, and its lockfile is byte-identical to the branch
that went red. The next push or scheduled run would have failed identically.
Reached through `reqwest`, a direct dependency, via `hyper-rustls` and
`tokio-rustls` — the model-download path.
Note the trap for anyone repeating this: plain `cargo update -p rustls` resolves
to 0.23.43, which is still inside the affected range. `--precise 0.23.45` is what
crosses the boundary, and it carries `rustls-webpki 0.103.13 -> 0.103.15` with
it. Five lockfile lines, no manifest change, no semver break.
Checked: `cargo check --features embed-model` exits 0 — that is the leg that
compiles reqwest at all, since `default = []`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔎 Code Graph impact reviewNo indexed code changed (1 changed file(s) not in the graph — new/non-code files). code-graph-mcp |
1 participant
A TLS 1.3 advisory published today turned
Cargo Auditred on a branch whoseCargo.lockhad not changed at all — the advisory database moved, not this repository.mainis affected and does not know it. Its last CI run was 10:47 UTC, before the advisory existed, and its lockfile is byte-identical to the branch that went red at 16:17. The next push or scheduled run fails identically. That is why this is a standalone PR rather than a commit inside #49 — main needs it whether or not #49 lands.Reached through
reqwest, a direct dependency, viahyper-rustlsandtokio-rustls.One trap worth recording: plain
cargo update -p rustlsresolves to 0.23.43, which is still inside the affected range.--precise 0.23.45is what crosses the boundary, and it carriesrustls-webpki 0.103.13 → 0.103.15with it.Five lockfile lines. No manifest change, no semver break, no source change.
Checked:
cargo check --features embed-modelexits 0 — the only leg that compiles reqwest, sincedefault = []. Pre-commit ran the full suite plus clippy on both feature legs.🤖 Generated with Claude Code