Update rustls to fix TLS handshake validation - #1003
Merged
Merged
Conversation
Reject TLS 1.3 handshake messages that cross encryption-level boundaries within a record by resolving the patched rustls release. This addresses RUSTSEC-2026-0285 and restores the security audit gate without suppressing checks or changing certificate verification policy. Closes #1002
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The lockfile's
rustls 0.23.44accepts TLS 1.3 handshake messages across encryption-level boundaries within a record and fails the security audit under RUSTSEC-2026-0285. Update only rustls to the patched0.23.45release and record the security fix in the changelog. The last release used affectedrustls 0.23.43.The existing
Cargo.tomlrange permits this patch, so only the rustls version/checksum inCargo.lockand the changelog change. Certificate verification policy, audit checks, and other resolved dependencies remain unchanged.Closes #1002
Priority
Merge this security update before the independent Dependabot grouping PR #1001. After a maintainer merges this PR, bring the updated main into #1001 and rerun its CI. The grouping change is not included here.
Validation
cargo audit: passed; RUSTSEC-2026-0285 no longer reported. The existing non-fatal unmaintainedrustls-pemfilewarning remains.scripts/preflight/run-all.sh: quality checks passed, including Rust formatting, Clippy, rustdoc, Python formatting/lint, Biome, Markdown lint, docs, audit, and compose/E2E script validation. The run then stopped at deploy smoke because OrbStack was already listening on port 8200.cargo test: passed, 2,807 tests passed, 0 failed, 39 ignored. Local platform-specific/ignored coverage is not a substitute for Linux CI fixtures.RUST_LOG=info scripts/preflight/ci/e2e-matrix.sh: local-no-hosts passed, including issuance, credential rotation/recovery, CA key rotation, and audit assertions. local-hosts could not run becausesudo -nrequires a password on this host; the remaining matrix arms were not reached. CI must gate those arms, as permitted by AGENTS.md. The initial attempt inheritedRUST_LOG=warn, which hid the harness's info-level readiness message; the explicit info-level rerun resolved that local setup issue without code changes.git diff --check: passed; reviewed the two-file diff.CI completed successfully: Quality Check (including cargo audit), Markdown/shared-instruction drift, Unit & CLI Smoke (including monitoring and deploy smoke), and all 14 Docker E2E matrix arms passed. The docs-only companion job was correctly skipped. CodeQL also passed for Actions, Python, and Rust. No CI check was weakened or bypassed.