[bonk-ai]

What and why

rustls 0.23.45 to 0.23.46 in the root Cargo.lock, for the four advisories RustSec published on 2026-10-14 at 12:00Z: RUSTSEC-2026-0346 (GHSA-c8m5-c952-6cm4), RUSTSEC-2026-0347 (GHSA-vp88-798v-h67f), RUSTSEC-2026-0348 (GHSA-h2v8-394m-p7vv) and RUSTSEC-2026-0349 (GHSA-w44r-93j7-qv28). Since then cargo deny check fails advisories on main's lockfile, so mise run check and the required semgrep, secret history, licenses, workflow lint job fail on every branch cut from main. No other crate moved, crates/agentd/fuzz/Cargo.lock holds no rustls, and no Cargo.toml changed. The branch starts from main at 279f28f.

Who reaches rustls

microvms-edges does, through aws-smithy-http-client, hyper-rustls, reqwest, tokio-tungstenite and quinn, so the CLI, microvms-core and both bindings do too (cargo tree -i rustls@0.23.46 -e normal). agentd doesn't link rustls. No crate in the workspace builds its own ClientConfig (git grep finds none), so every client uses rustls's defaults, resumption included.

Which advisories apply

• RUSTSEC-2026-0349 applies: the client records the server's key-exchange group before the server is authenticated and predicts the next ClientHello's key share from it, so a network attacker can make later connections to that name skip the post-quantum share when the server accepts the classical one. Resumption, which our clients leave on, is what keeps the record.
• RUSTSEC-2026-0346 needs a custom ClientSessionStore that formats session values with Debug; we have none.
• RUSTSEC-2026-0347 needs Encrypted Client Hello; nothing here configures it.
• RUSTSEC-2026-0348 needs rustls's brotli feature; the lockfile has no brotli crate.

changelog.d/618.security.md records the update for the next release, because the published CLI, wheel and npm package carry the rustls they were built with.

Release check

rustls 0.23.46 was published 2026-10-14T09:54Z by ctz, a rustls maintainer, and isn't yanked (crates.io, read 2026-10-14). Its release notes list the four advisories and the twelve fixes taken from main; none changes an API this workspace calls, and clippy with -D warnings passed.

Transport stack

This is the TLS stack under the AWS SDK's HTTP client, reqwest and the tunnel's WebSocket. Verified offline only: a live conformance run on main follows this merge.

Evidence

• mise run check, run bare on this tree: EXIT=0 in 291 s, 69 test result: lines, 1818 passed, 0 failed, [security] advisories ok, bans ok, licenses ok, sources ok, and prose:check "0 errors, 4069 warnings", the same count as main.
• cargo update -p rustls at the root: "Updating rustls v0.23.45 -> v0.23.46", one package locked; in crates/agentd/fuzz the package ID matches nothing.
• ./tools/changelog.py check: "3 fragments in changelog.d/, and they build".
• mise run pr-body:check -- --body <this body>: EXIT=0.
• Live conformance run: not run on this tree.

Parity

• No public name changed on any surface (core, CLI commands, microvms.pyi, index.d.ts).

Guards

None: this adds no guard. cargo deny check advisories, already in check and CI, is what fails without it.

Follow-ups

• The published 1.0.1 CLI, wheel and npm package still carry rustls 0.23.45 until the next release; main holds feat(agentd): an image-set default user for execs that omit user (#595) #600's feature, so that release is 1.1.0 (tracker tracking: 1.1.1, an image-set default user that works end to end #605).

Platform claims

• Not applicable: this changes no claim about AWS behavior.

Scope

• This is not an orchestrator or a fork implementation
  (see docs/STRATEGY.md).