From 49314ad9ddc013160f8ab11ba3657305a6045c9b Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Mon, 12 Oct 2026 12:13:43 +1100 Subject: [PATCH 1/2] fix(deps): patch rustls to 0.23.45 Addresses GHSA-2mjx-qc3c-rqvc (RUSTSEC-2026-0285) in all four Cargo.lock files. rustls 0.23.45 requires aws-lc-rs ^1.18 and rustls-webpki ^0.103.14, so those move too where needed. --- Cargo.lock | 8 ++--- .../packages/protect-ffi/Cargo.lock | 29 ++++++++++++------- packages/eql/Cargo.lock | 17 ++++++----- packages/stack-auth/fuzz/Cargo.lock | 8 ++--- 4 files changed, 35 insertions(+), 27 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 5af242d0f..de7a51c30 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2789,9 +2789,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.36" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -2852,9 +2852,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", diff --git a/languages/typescript/packages/protect-ffi/Cargo.lock b/languages/typescript/packages/protect-ffi/Cargo.lock index 4bb353a2a..e1c5dc9c2 100644 --- a/languages/typescript/packages/protect-ffi/Cargo.lock +++ b/languages/typescript/packages/protect-ffi/Cargo.lock @@ -213,9 +213,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "aws-lc-rs" -version = "1.16.3" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", "untrusted 0.7.1", @@ -224,14 +224,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.40.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -1079,7 +1080,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] @@ -2333,6 +2334,12 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" +[[package]] +name = "pkg-config" +version = "0.3.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" + [[package]] name = "polyval" version = "0.6.2" @@ -2972,9 +2979,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.37" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -3024,7 +3031,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] @@ -3035,9 +3042,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", @@ -4400,7 +4407,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.48.0", ] [[package]] diff --git a/packages/eql/Cargo.lock b/packages/eql/Cargo.lock index e053231f3..f7b0377fd 100644 --- a/packages/eql/Cargo.lock +++ b/packages/eql/Cargo.lock @@ -224,9 +224,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", "untrusted 0.7.1", @@ -235,14 +235,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -3534,9 +3535,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -3597,9 +3598,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", diff --git a/packages/stack-auth/fuzz/Cargo.lock b/packages/stack-auth/fuzz/Cargo.lock index 5b3ee6b78..4633316a6 100644 --- a/packages/stack-auth/fuzz/Cargo.lock +++ b/packages/stack-auth/fuzz/Cargo.lock @@ -2275,9 +2275,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.36" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -2338,9 +2338,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", From 457b28ea519f8496afe7d376b0b42cb3f55356a4 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 04:48:11 +0000 Subject: [PATCH 2/2] chore(changeset): release the rustls 0.23.45 patch Add patch changesets for @cipherstash/protect-ffi (and its six platform packages) and @cipherstash/auth, so the lockfile bump to rustls 0.23.45 (GHSA-2mjx-qc3c-rqvc) ships in its own release rather than depending on unrelated pending changesets. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01FboWTTDJN1UFUDUzSzHzNH --- .changeset/auth-rustls-0-23-45.md | 6 ++++++ .changeset/protect-ffi-rustls-0-23-45.md | 12 ++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 .changeset/auth-rustls-0-23-45.md create mode 100644 .changeset/protect-ffi-rustls-0-23-45.md diff --git a/.changeset/auth-rustls-0-23-45.md b/.changeset/auth-rustls-0-23-45.md new file mode 100644 index 000000000..02ee2d408 --- /dev/null +++ b/.changeset/auth-rustls-0-23-45.md @@ -0,0 +1,6 @@ +--- +"@cipherstash/auth": patch +--- + +The native binaries now use rustls 0.23.45, which fixes GHSA-2mjx-qc3c-rqvc +(affecting rustls 0.23.13 up to 0.23.44). The package's API is unchanged. diff --git a/.changeset/protect-ffi-rustls-0-23-45.md b/.changeset/protect-ffi-rustls-0-23-45.md new file mode 100644 index 000000000..9bcf792bd --- /dev/null +++ b/.changeset/protect-ffi-rustls-0-23-45.md @@ -0,0 +1,12 @@ +--- +"@cipherstash/protect-ffi": patch +"@cipherstash/protect-ffi-darwin-arm64": patch +"@cipherstash/protect-ffi-darwin-x64": patch +"@cipherstash/protect-ffi-linux-arm64-gnu": patch +"@cipherstash/protect-ffi-linux-x64-gnu": patch +"@cipherstash/protect-ffi-linux-x64-musl": patch +"@cipherstash/protect-ffi-win32-x64-msvc": patch +--- + +The native binaries now use rustls 0.23.45, which fixes GHSA-2mjx-qc3c-rqvc +(affecting rustls 0.23.13 up to 0.23.44). The package's API is unchanged.