From 19479c67d8896828b34786772c7926df3932e712 Mon Sep 17 00:00:00 2001 From: grumbach Date: Fri, 16 Oct 2026 12:28:58 +0900 Subject: [PATCH 1/2] chore(deps): move rustls to 0.23.46 for four RustSec advisories `cargo audit` fails on RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 against `rustls` 0.23.45. All four are fixed in 0.23.46. They reached the RustSec database on 2026-10-14. Only the `rustls` entry in `Cargo.lock` changes (version and checksum). 0.23.45 and 0.23.46 declare the same dependencies and `rust-version`, every existing requirement on `rustls` already allows the new patch, and the unique package lines of `cargo tree --locked --workspace --all-features --target all -e normal,build,dev --prefix none` differ only in the `rustls` version. `cargo audit` still fails after this change, on five advisories against `quinn-proto` 0.11.16 (RUSTSEC-2026-0338 to RUSTSEC-2026-0342). That entry is left for a separate change; `quinn-proto` is in the lockfile only and `cargo tree` does not list it, so no build compiles it. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a0f5b0d..9f0306c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4206,9 +4206,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", From 19fd80ce9481ef02eca79e2c0807d4471ff9b851 Mon Sep 17 00:00:00 2001 From: grumbach Date: Tue, 20 Oct 2026 09:53:27 +0900 Subject: [PATCH 2/2] chore(deps): move quinn-proto to 0.11.18 for five RustSec advisories `cargo audit` fails on RUSTSEC-2026-0338, RUSTSEC-2026-0339, RUSTSEC-2026-0340, RUSTSEC-2026-0341 and RUSTSEC-2026-0342 against `quinn-proto` 0.11.16. 0.11.18 is the first release that fixes all five. Only the `quinn-proto` entry in `Cargo.lock` changes (version and checksum). 0.11.16 and 0.11.18 declare the same dependencies, features and `rust-version`, and `quinn` 0.11.11, the only lockfile entry that depends on it, requires `^0.11.15`. `quinn-proto` is in the lockfile only: `cargo tree --all-features --target all -i quinn-proto` prints nothing, so no build compiles it, and the unique package lines of `cargo tree --locked --workspace --all-features --target all -e normal,build,dev --prefix none` are the same before and after. With this change `cargo audit` reports no vulnerabilities. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 9f0306c..2d76b4b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3763,9 +3763,9 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.16" +version = "0.11.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" +checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc" dependencies = [ "aws-lc-rs", "bytes",