Skip to content

fix(deps): bump rustls ≥0.23.45 (RUSTSEC-2026-0285) - #75

Closed
echobt wants to merge 0 commit into
mainfrom
droid/857cb16f-cli-rustls-bump-flash0731-co
Closed

echobt wants to merge 0 commit into
mainfrom
droid/857cb16f-cli-rustls-bump-flash0731-co

Conversation

@echobt

@echobt echobt commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Bumps rustls from 0.23.430.23.45 in Cargo.lock to address RUSTSEC-2026-0285 (Security Audit FAIL after #73). This mirrors backend #319.

  • rustls is reachable transitively via reqwest (rustls feature) → hyper-rustlstokio-rustls.
  • No direct rustls requirement in any Cargo.toml, so the only change is the lockfile pin.
  • No deny.toml / release_age exception exists in this repo (cargo audit's .cargo/audit.toml ignore list is already empty); no exception update was needed.

Verification

  • cargo audit audit: 0 vulnerabilities — RUSTSEC-2026-0285 no longer present with rustls 0.23.45.
  • cargo metadata: rustls resolves to 0.23.45.

Test plan

  • cargo audit
  • CI (cargo fmt, clippy, cargo test --workspace, TUI job, version check)

@echobt

echobt commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

@greptileai

@greptile-apps

greptile-apps Bot commented Sep 15, 2026

Copy link
Copy Markdown

Greptile Summary

The dependency lock remains on rustls 0.23.45 to address RUSTSEC-2026-0285. No changes were made since the previous review.

Confidence Score: 5/5

Safe to merge.

There are no outstanding findings and no changes since the previous review.

Reviews (2): Last reviewed commit: "fix(deps): bump rustls ≥0.23.45 (RUSTSEC..." | Re-trigger Greptile

@echobt

echobt commented Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

@greptileai

@echobt echobt closed this Sep 16, 2026
@echobt
echobt force-pushed the droid/857cb16f-cli-rustls-bump-flash0731-co branch from 11505ad to 71aadd4 Compare September 16, 2026 18:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant