Take rustls past RUSTSEC-2026-0285

[vmillet-dev]

Cargo advisories and licenses went red, and not because of the PR it went red
on. rustls 0.23.42 has been in the lockfile since before today; the advisory
was published between main's last Security run this morning and now, and #126
happened to be the first run after it.

error[vulnerability]: TLS 1.3 handshake messages incorrectly accepted across
                      encryption level boundaries
  rustls 0.23.42  →  RUSTSEC-2026-0285
  reached through: tauri-plugin-updater → reqwest → {hyper-rustls, tokio-rustls,
                                                     rustls-platform-verifier}

The handshake transcript stays authenticated, so a network-position attacker
cannot alter or complete a handshake. The practical effect is narrower: a peer
could send in plaintext what should have been encrypted, and rustls would not
reject the connection. Functionally the same bug as Go's CVE-2025-61730.

tauri-plugin-updater is the only thing in this tree that speaks TLS.

⚠️ --precise, and it is necessary

cargo update -p rustls stops at 0.23.43, which is still below the fix — its
MSRV-aware resolution respects rust-version = "1.88" and will not reach further
on its own. The advisory wants ≥ 0.23.45, and the pinned toolchain is 1.97.1,
so --precise 0.23.45 resolves cleanly. It brings rustls-webpki 0.103.13 →
0.103.15 with it.

Lockfile only — no manifest change, no MSRV change.

Checked locally

cargo test all green, cargo clippy --all-targets -D warnings and cargo fmt --check clean.

🤖 Generated with Claude Code