fix(deps): patch rustls and preserve reviewed release dependencies

[lemon07r]

Rustls 0.23.43 accepts TLS 1.3 handshake messages across encryption level boundaries (RUSTSEC-2026-0285). Update the lockfile to the first patched version, 0.23.45, under the existing 0.23 requirement.

Release version stamping now uses cargo update --workspace and locked builds so packaging retains the reviewed dependency graph. A disposable 1.4.2 stamping rehearsal changed only the four first-party workspace package versions; rustls and every external package/edge stayed intact. This patch excludes #281's unrelated tempfile/getrandom change and proposed retrieval modules.

Validation: locked metadata; formatting; locked all-target workspace Clippy; locked workspace tests and all-target compilation; cargo-deny; cargo-audit; cargo-machete. RustSec reports no rustls advisory after the update. The three previously justified advisory warnings remain unchanged. Actual Rust 1.88 and Windows setup-probe checks run in CI.

References: https://rustsec.org/advisories/RUSTSEC-2026-0285.html and https://doc.rust-lang.org/cargo/commands/cargo-update.html.

---

---

Summary by cubic

Patches rustls from 0.23.43 to 0.23.45 to close the TLS 1.3 handshake message boundary vulnerability (RUSTSEC-2026-0285), and locks release packaging to the reviewed dependency graph.

• Release stamping now uses cargo update --workspace and builds with --locked so external dependency versions stay as reviewed.
• The unrelated tempfile/getrandom change from feat(retrieval): MMR diversification, multi-hop graph analysis, and context enrichment #281 is intentionally excluded.

^{Written for commit fadb635. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated the release process to synchronize workspace dependencies after setting the release version.
  • Release builds now use the locked dependency versions without changing the lockfile.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: VeraTools/vera/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 07499436-d667-4394-8509-c30e71e45d48

📥 Commits

Reviewing files that changed from the base of the PR and between 0e44ab1 and fadb635.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .github/workflows/release.yml

 __________________________________
< Code Wars Episode IV: A New Bug. >
 ----------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.