From 724be139d3bc565e60ba404a7d4530d021b3a755 Mon Sep 17 00:00:00 2001 From: Valentin Millet Date: Tue, 15 Sep 2026 04:05:50 +0200 Subject: [PATCH] Take rustls past RUSTSEC-2026-0285 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TLS 1.3 handshake messages were accepted across encryption level boundaries. The handshake transcript stays authenticated, so a network-position attacker cannot alter or complete one — the effect is that a peer could send in plaintext what should have been encrypted without the connection being rejected. Reached through tauri-plugin-updater, which is the only thing here that speaks TLS. Both packages named on one command: 0.23.45 wants webpki ^0.103.14 and the lockfile held 0.103.13, so updating rustls alone falls back to 0.23.43 — which is still below the fix — rather than move a sibling. Co-Authored-By: Claude Opus 5 --- src-tauri/Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index cb868d7..38dc923 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -3577,9 +3577,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.42" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -3639,9 +3639,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",