build(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285

[hyperb1iss]

What this changes

Cargo.lock moves rustls from 0.23.43 to 0.23.45, which also takes aws-lc-sys from 0.42.0 to 0.45.0 and rustls-webpki from 0.103.13 to 0.103.15. No source changes.

Why

RUSTSEC-2026-0285 landed in the advisory database and cargo deny now fails every CI run on main, which blocks the release lane (the tag lane needs rust-deny). rustls 0.23.43 accepted TLS 1.3 handshake messages sent at the wrong encryption level after a key change in the same record; the fix is 0.23.45. The transcript stays authenticated, so this was never a forged-handshake path, but the gate is the gate.

Verification

• cargo deny check in the bumped tree: advisories, bans, licenses, and sources all ok.

• cargo check -p hypercolor-driver-hue (the smallest rustls dependent) compiles the new aws-lc-sys 0.45.0 and finishes clean.

• All three crates declare a 1.71 MSRV, below the workspace's 1.94.

• The full workspace build and test run is CI's job on this PR; it was not run locally.

• Added or updated tests (not applicable; lockfile only)

• Added or updated docs (not applicable)

• just verify passes locally (not run; CI covers the workspace build)

• just deny passes (required for dependency or license changes)

• just ui-test and just ui-build pass (not applicable)

• just sdk-lint, just sdk-check, and just sdk-build pass (not applicable)

• just python-verify passes (not applicable)

• just compat-check passes (not applicable)

• just docs-build passes (not applicable)

• cd docs && zola check passes (not applicable)

• Packaging scripts were syntax-checked (not applicable)

• just e2e-build passes with the normal Servo stack (not applicable)

• just e2e-build-cpu passes when validating the CPU smoke fallback (not applicable)

• just e2e passes against the Servo stack (not applicable)

• Tested on real hardware, simulator, or e2e harness (not applicable)

Notes for reviewers

aws-lc-sys is a C build, so the Windows and macOS lanes are the ones worth watching on this PR. A plain cargo update -p rustls resolved nothing under the MSRV-aware resolver; the bump uses --precise 0.23.45.

🤖 Generated with Claude Code

https://claude.ai/code/session_013dXbUNEe4yxrGhQLXbzRou

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: cb003bc4-1e81-4ea5-b0f5-aa1a96867fd0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}