[bb7133]

What problem does this PR solve?

Issue Number: ref #1388

Problem Summary:

The Audit dependencies and policy job (make rust-supply-chain: cargo audit + cargo deny) fails on every PR against rust because of RustSec advisories in locked dependencies:

• rustls 0.23.45, rustls-webpki 0.103.15, quinn-proto 0.11.17 (reported on replayer: add bounded Rust dry-run foundation #1388)
• since then also: tokio 1.47.1 (RUSTSEC-2026-0386, unsound AsyncFd constructors, denied as a warning by rust/.cargo/audit.toml), ctutils 0.4.2 (RUSTSEC-2026-0385), pulldown-cmark 0.13.4 (RUSTSEC-2026-0414)

What is changed and how it works:

Dependency versions only, keeping the workspace's exact-pin policy:

crate	from	to	how
rustls	=0.23.45	=0.23.46	workspace pin
tokio	=1.47.1	=1.51.6	workspace pin; 1.51 is an LTS line and has no patched 1.47.x
socket2	=0.6.1	=0.6.3	workspace pin; required by tokio 1.51
tokio-macros	2.5.0	2.7.1	lockfile; held below 2.7.2 so syn stays on one major version (multiple-versions = "deny")
rustls-webpki	0.103.15	0.103.16	lockfile
quinn-proto	0.11.17	0.11.19	lockfile
ctutils	0.4.2	0.4.7	lockfile
pulldown-cmark	0.13.4	0.13.5	lockfile (build-only, via prost-build)

tokio 1.51 no longer pulls io-uring/backtrace/windows-targets 0.53, so the lockfile shrinks.

One test change: tokio 1.51 deprecates TcpStream::set_linger; the dataplane hard-close test now uses the equivalent set_zero_linger() (still SO_LINGER=0 → RST).

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Local (rust 1.89.0, macOS arm64): rust/ci/check-supply-chain.sh with cargo-audit 0.22.2 / cargo-deny 0.20.2 → advisories, bans, licenses, sources ok; rust/ci/run-negative-tests.sh ok; cargo fmt --check ok; cargo clippy --workspace --all-targets --locked -- -D warnings ok; cargo test --workspace --locked all pass (dataplane session_engine 93/93).

Notable changes

• Has configuration change
• Has HTTP API interfaces change
• Has tiproxyctl change
• Other user behavior changes

Release note

None

🤖 Generated with Claude Code

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xhebox for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1

• release-*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cc220095-884d-4231-82ed-40f97874f5e0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-30T02:49:52.906870Z We couldn’t complete this review. Comment @codex review to try again.	7c12096	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (rust@2e51931). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             rust    #1403   +/-   ##
=======================================
  Coverage        ?   58.55%           
=======================================
  Files           ?      214           
  Lines           ?    29850           
  Branches        ?        0           
=======================================
  Hits            ?    17478           
  Misses          ?    10884           
  Partials        ?     1488           

Flag	Coverage Δ
unit	58.55% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.