From 982995de5b3565842698ea6f5d31079df10f27cd Mon Sep 17 00:00:00 2001 From: Jacob Page Date: Thu, 8 Oct 2026 11:16:35 -0700 Subject: [PATCH] chore(deps): bump rustls to 0.23.45 (GHSA-2mjx-qc3c-rqvc) rustls < 0.23.45 accepts TLS 1.3 handshake messages across encryption level boundaries. rustls is a transitive dependency via reqwest, so this is a lockfile-only update; every dependent's version requirement already allows 0.23.45. rustls-webpki moves from 0.103.13 to 0.103.15 because rustls 0.23.44+ requires ^0.103.14. Dependabot could not resolve the two together (security_update_not_possible, capped at 0.23.43). Co-Authored-By: Claude Sonnet 5.5 --- Cargo.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 32c218a..d32c707 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2203,9 +2203,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -2266,9 +2266,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", @@ -2683,7 +2683,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.2", + "getrandom 0.3.4", "once_cell", "rustix", "windows-sys 0.61.2",