[kvinwang]

Problem

sdk/rust/Cargo.lock still pins:

• rustls 0.23.45: RUSTSEC-2026-0346, -0347, -0348, -0349 (fixed in 0.23.46). The workspace lock got the same bump in chore(deps): bump rustls and h2 for RUSTSEC advisories #1473; rustls-webpki here is already 0.103.16 via fix(sdk): pick up the emSign CA fixes in the Rust and Python SDK locks #1467.
• ruint 1.19.0 (pulled in through alloy): RUSTSEC-2026-0220 (fixed in 1.20.0).

Fix

cargo update -p rustls and cargo update -p ruint --precise 1.20.0 in sdk/rust. Lockfile only, one version and checksum each. The ruint update also re-pointed the windows-sys edges of errno, rustix, tempfile and quinn-udp from 0.61.2 to 0.52.0; those are unrelated and reverted, and cargo metadata --locked accepts the result without rewriting it.

Left as is: hickory-proto (needs 0.26, which reqwest 0.12 rules out), rsa (no fix upstream), and quinn-proto (in the lockfile but compiled under no feature set).

Verification

With the simulator running (sdk/simulator/lifecycle.sh): cargo test --workspace in sdk/rust passes (55 tests) and cargo run --example dstack_client_usage succeeds.