From cf8c450d0b8c771fc814d52930bbc00f7d398caa Mon Sep 17 00:00:00 2001 From: Loris Leiva Date: Thu, 17 Sep 2026 22:45:28 +0100 Subject: [PATCH] Update rustls to address RUSTSEC-2026-0285 This PR bumps the locked `rustls` from 0.23.29 to 0.23.45 (along with the `rustls-webpki` 0.103.15 it requires) to clear RUSTSEC-2026-0285, in which TLS 1.3 handshake messages were accepted across encryption level boundaries. The advisory was published on 14 September and has been failing the audit job on every run since. The crate only reaches the workspace through the Rust client's optional `fetch` feature via `solana-rpc-client` and `reqwest`, so this is a lockfile-only change with no manifest edits. --- Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 4fa0151..9a21478 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3019,9 +3019,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.29" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2491382039b29b9b11ff08b76ff6c97cf287671dbb74f0be44bda389fffe9bd1" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -3043,9 +3043,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.4" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",