From f277f2bcb54e8643e8c3aa51efe11e0a0bd3eb4e Mon Sep 17 00:00:00 2001 From: Stefanie Jane Date: Tue, 15 Sep 2026 12:20:29 -0700 Subject: [PATCH] build(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 cargo-deny now fails every CI run on RUSTSEC-2026-0285: rustls 0.23.43 accepted TLS 1.3 handshake messages sent at the wrong encryption level after a key change in the same record. The handshake transcript stays authenticated, so the practical effect was accepting plaintext messages that should have been encrypted rather than a forged handshake, but the advisory gate blocks the release lane regardless. The precise bump also moves aws-lc-sys 0.42.0 to 0.45.0 and rustls-webpki 0.103.13 to 0.103.15, all with a 1.71 MSRV. The Hue driver, the smallest rustls dependent, check-compiles against the new aws-lc-sys. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013dXbUNEe4yxrGhQLXbzRou --- Cargo.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index e53ffdcd9..5a3b2ca3a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -760,9 +760,9 @@ dependencies = [ [[package]] name = "aws-lc-rs" -version = "1.17.1" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", "zeroize", @@ -770,9 +770,9 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.42.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", @@ -10217,9 +10217,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "log", @@ -10303,9 +10303,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring",