Move rustls to 0.23.46 for RUSTSEC-2026-0346 through -0349

Merged
JE
8d ago
+4-4

cargo deny and Rust (stable) fail on main because of four new rustls advisories, RUSTSEC-2026-0346, -0347, -0348 and -0349. cargo-deny's solution for each is >=0.23.46.

Rust (stable) fails on the advisories alone. In run 39065506006, every step through Lint, Test and Docs passes. The tests report 0 failed throughout. The only failed step is Deny (make rs-deny), which fails with advisories FAILED, bans ok, licenses ok, sources ok. The steps after it, which include generated-code drift and the publish dry run, were skipped and run on this PR.

What changes: cargo update -p rustls --precise 0.23.46 in rust/ and conformance/runner/rust/. Each lockfile changes only rustls, from 0.23.45 to 0.23.46. Its dependents (hyper-rustls 0.27.9, tokio-rustls 0.26.5, rustls-platform-verifier 0.7.0 and reqwest 0.13.5) already accept it. All four advisories have a fix, so deny.toml gets no ignore entries.

Verified locally:

  • make -C rust deny reports advisories ok, bans ok, licenses ok, sources ok for both workspaces.
  • make rs-check rs-check-drift passes, with no Rust service drift.

Summary by cubic

Updates rustls to 0.23.46 in both Rust lockfiles to fix four security advisories (RUSTSEC-2026-0346 through -0349). Only the rustls version changes, from 0.23.45 to 0.23.46, because its dependents already accept the update. cargo deny now passes in both workspaces.