From 1a0dbfbcb6e7c6e33b1e557b41a416ba9a6e7f27 Mon Sep 17 00:00:00 2001 From: xiaolai Date: Tue, 15 Sep 2026 10:15:30 +0800 Subject: [PATCH] fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 RUSTSEC-2026-0285 (TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries) affects rustls 0.23.41, which src-tauri/Cargo.lock pinned. The rust-audit job fails on it, and rust-audit feeds the required rust check, so every open PR was blocked. A plain cargo update -p rustls stops at 0.23.43, still vulnerable, because 0.23.44 and later need newer aws-lc-rs and rustls-webpki. So the update is pinned to the patched release, which moves: rustls 0.23.41 -> 0.23.45 rustls-webpki 0.103.13 -> 0.103.15 aws-lc-rs 1.17.0 -> 1.18.1 aws-lc-sys 0.41.0 -> 0.45.0 rustls reaches the app through reqwest, hyper-rustls, rustls-platform-verifier and tauri-plugin-updater. Lockfile only; no manifest changes. --- src-tauri/Cargo.lock | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 4efc3b107..63e5c2c7e 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -318,9 +318,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", "zeroize", @@ -328,14 +328,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -4328,9 +4329,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.41" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -4392,9 +4393,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring",