chore(deps): bump rustls from 0.23.43 to 0.23.44 - #6105
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
|
Thanks @dependabot[bot] for taking the time to contribute. This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered. Please read |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Bumps [rustls](https://github.com/rustls/rustls) from 0.23.43 to 0.23.44. - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.43...v/0.23.44) --- updated-dependencies: - dependency-name: rustls dependency-version: 0.23.44 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/cargo/rustls-0.23.44
branch
from
September 14, 2026 02:19
97a8317 to
ca3e52b
Compare
Hmbown
pushed a commit
that referenced
this pull request
Sep 15, 2026
#6105 bumped rustls 0.23.43 -> 0.23.44 and landed on main, but the advisory still fires: cargo-deny's own output says "Solution: Upgrade to >=0.23.45". 0.23.44 is not the patched release, so every open PR kept a red cargo-deny (advisories) and cargo-audit for a reason nobody's diff caused. RUSTSEC-2026-0285 is "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries" — it reaches us through every HTTP path we have (reqwest 0.12 and 0.13, hyper-rustls, tokio-rustls, rustls-platform-verifier), so this is the whole provider wire, not a dev-only dependency. `cargo update -p rustls` only: one package moved, 102 unchanged dependencies left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Hmbown
added a commit
that referenced
this pull request
Sep 15, 2026
51 commits. Lands the v0.9.14 slice-2 work plus overnight CI triage. Fixed to get here: - RUSTSEC-2026-0285 — rustls 0.23.45 (#6105's 0.23.44 was not the patched release) - web fact staleness, in both the generated and the hand-maintained copy - seven clippy errors, five only reachable via --all-targets - Test (windows-latest) compile break: ShellKind's dead_code expectations were unix-first - ACP session/new minting ids session/load could not resolve (#6174) - PTY harness sealed against a live local Ollama - workspace instruction relative_path made platform-independent - pet_watch Windows test racing a 500ms audio freshness window (#6224) - pet conformance: one whale body across all five copies (#6227) — 380 checkpoints, first time green Reverted in-branch: the #6207 store-adoption fix, whose predicate sampled emptiness with no liveness check. Merging with two non-required checks red, neither from this branch: - CodeQL: 34 pre-existing high alerts on main - Codewhale review: a provider-spend gate requiring 5 passes, not a code failure All three required checks green: Lint, Test (windows-latest), npm wrapper smoke (ubuntu-latest).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps rustls from 0.23.43 to 0.23.44.
Commits
64ad386Bump version to 0.23.441efbf66bogo: remove PostQuantum setupe78162faws-lc-rs: add support for ML-DSA signaturesd880772bogo: extract Options::provider() helper87201d6bogo: force all callers to get provider from Options93657e3server: limit 1.2 certificate requests to 1.2-compatible signature schemesbbd3c9aclient: avoid sending 1.3-only signature schemes if no cipher suites configuredeb57688tls12: require known signature algorithme7a9ceftls12: send illegal_parameter alert for kx signed with wrong algorithm06a546dbogo: take latest