From abd6327f10b954f0471dfc7ece0126411046d2a1 Mon Sep 17 00:00:00 2001 From: Martin Pluskal Date: Sun, 18 Oct 2026 08:35:58 +0200 Subject: [PATCH] build(deps): bump rustls to 0.23.46 rustls 0.23.45 carries four client-side advisories that fail cargo deny on main and on every PR: RUSTSEC-2026-0346 (a derived Debug on TLS session values included the session secrets), RUSTSEC-2026-0347 (a rejected Encrypted Client Hello was completed against the outer ClientHello), RUSTSEC-2026-0348 (the optional brotli certificate decompressor's output bound) and RUSTSEC-2026-0349 (the key-exchange group was recorded before the server was authenticated). bugwarden is a TLS client of Bugzilla through reqwest, so the client paths apply. 0.23.46 fixes all four; it is a lock-only patch bump and still declares rust-version 1.71, below the workspace MSRV. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7dcc32e..a4ad859 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1658,9 +1658,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell",