Patch rustls and move to Go 1.26.9 for new security advisories
Main's Security run has been red since 2026-10-12, and every PR's checks with it: cargo deny fails on new rustls advisories and govulncheck on new Go stdlib net/http advisories. Two lines fix both.
| Advisory | Where | Fix |
|---|---|---|
RUSTSEC-2026-0346 — Debug impls for client session values expose TLS secrets | rust/Cargo.lock rustls 0.23.45 | rustls 0.23.46 (patched >=0.23.46) |
| RUSTSEC-2026-0347 — buffered application data sent to outer server after ECH rejection | same | same |
| RUSTSEC-2026-0348 — Brotli cert decompression can allocate 1 GiB pre-auth | same | same |
| RUSTSEC-2026-0349 — unauthenticated ServerHello can downgrade later connections to classical key exchange | same | same |
| GO-2026-6617 — HTTP/2 server crash from HPACK encoder race in net/http | go/go.mod toolchain go1.26.8 | toolchain go1.26.9 |
| GO-2026-6613 — net/http | same | same |
- Rust:
cargo update -p rustlsinrust/; only rustls moved (hyper-rustls, tokio-rustls, rustls-platform-verifier, rustls-webpki already accept 0.23.46). Theconformance/runner/rustworkspace doesn't depend on rustls and already passescargo deny. - Go:
go/go.mod'stoolchainline was the only 1.26.8 pin. Everysetup-gostep readsgo-version-file: go/go.mod;.mise.tomlfloats on1.26, and the othergo.modfiles andgo.workcarry no toolchain line. No Dockerfiles pin Go.
Verified locally (each gated on exit status): make rs-check (incl. cargo deny over both workspaces), govulncheck ./... under go1.26.9 ("No vulnerabilities found"), make go-check, conformance-runner-tests-{go,rust}, conformance-{go,rust} (312/312 Rust; 310 pass, 2 skipped Go).
Summary by cubic
Fixes the security checks that have been red since 2026-10-12 by updating rustls to 0.23.46 and the Go toolchain to 1.26.9. These clear four new rustls advisories (RUSTSEC-2026-0346 through -0349) and two Go net/http advisories (GO-2026-6617 and GO-2026-6613) that were failing cargo deny and govulncheck on every PR.
Bug Fixes
cargo update -p rustlsinrust/; onlyrustlsmoved, and the conformance runner workspace doesn't depend on it.go/go.mod'stoolchainline was the only 1.26.8 pin; everysetup-gostep reads its version from that file.