[barnumbirr]

cargo audit reports four advisories against rustls 0.23.43, the TLS stack behind every HTTPS request rustman sends:

• RUSTSEC-2026-0349: an unauthenticated ServerHello can downgrade later connections to classical key exchange.
• RUSTSEC-2026-0285: TLS 1.3 handshake messages are accepted across encryption level boundaries.
• RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication.
• RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets.

The first two apply to an HTTP client like this one; 0348 needs rustls's brotli feature, which is off here. 0.23.46 fixes all four and is semver-compatible. The update also moves aws-lc-rs from 1.17.0 to 1.18.2, aws-lc-sys from 0.41.0 to 0.46.0 (AWS-LC 5.11.0) and rustls-webpki from 0.103.13 to 0.103.15. crossbeam-epoch goes from 0.9.18 to 0.9.21 for RUSTSEC-2026-0204, an invalid pointer dereference in its fmt::Pointer impl.

cargo update -p rustls
cargo update -p crossbeam-epoch

It only touches Cargo.lock, and it is independent of #65: squash-merged in either order, the two give the same tree, and cargo accepts the combined lock unchanged under --locked.

cargo audit goes from 15 vulnerabilities to 10. The rest are quinn-proto, which is in the lock but not compiled on Linux; quick-xml, which only wayland-scanner uses at build time; and zip 8, whose fix is zip 9 and needs calamine to move first. Neither calamine nor the updater calls the extract APIs those three advisories are about.

Testing

• cargo test: 139 passed and 3 ignored with default features, 131 and 3 with --no-default-features, the same as master.
• The release build under Xvfb: an HTTPS request to a local server whose CA is not trusted fails without reaching it. Once the CA is in the system trust store, requests complete against a TLS 1.3 server and against a server capped at TLS 1.2. Master behaves the same.
• cargo check --all-targets --target x86_64-pc-windows-gnu passes with master's one warning (APP_ID is never used).
• Rust 1.88.0 checks clean with and without default features, and the per-crate rust-version floors are the same as on master.
• Built under Debian's dpkg-buildpackage, whose CFLAGS carry -O2, aws-lc-sys 0.46.0 compiles without the jitterentropy error that 0.45.0 hit ("The CPU Jitter random number generator must not be compiled with optimizations." in 1.18.1 and -sys 0.45.0 aws/aws-lc-rs#1252).
• The release binary is 1,181,056 bytes smaller (22,314,168 against 23,495,224), mostly in .text. I have not traced which upstream change accounts for it.

Not tested on macOS, nor at runtime on Windows; WebSocket over TLS was not exercised.