From 7742b56693bd4d77bd053800bcb3f232ab317d51 Mon Sep 17 00:00:00 2001 From: grumbach Date: Fri, 16 Oct 2026 12:28:58 +0900 Subject: [PATCH] chore(deps): move rustls to 0.23.46 for four RustSec advisories `cargo audit` fails on RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 against `rustls` 0.23.45. All four are fixed in 0.23.46. They reached the RustSec database on 2026-10-14. Since then `main`'s lockfile fails `cargo audit`, and the Security Audit job fails whenever CI runs on a PR that still locks `rustls` 0.23.45. Only the `rustls` entry in `Cargo.lock` changes (version and checksum). 0.23.45 and 0.23.46 declare the same dependencies and `rust-version`, every existing requirement on `rustls` already allows the new patch, and the unique package lines of `cargo tree --locked --workspace --all-features --target all -e normal,build,dev --prefix none` differ only in the `rustls` version. `cargo update -p rustls` also moves `tempfile` from `getrandom` 0.4.3 to 0.3.4, a crate this fix has no reason to touch, so that line is kept as it was. Cargo 1.95, 1.98 and 1.99 accept the lockfile under `--locked` and find nothing to change with `--precise 0.23.46`. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 751d4f04..6100b816 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5218,9 +5218,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log",