From 9f926e55da9d827ef7f7597a2f33b3783b4fef3a Mon Sep 17 00:00:00 2001 From: Loris Leiva Date: Fri, 18 Sep 2026 15:15:58 +0100 Subject: [PATCH] Update rustls to address RUSTSEC-2026-0285 This PR bumps the locked `rustls` from 0.23.38 to 0.23.45 (along with the `rustls-webpki` 0.103.15 it requires) to clear RUSTSEC-2026-0285, in which TLS 1.3 handshake messages were accepted across encryption level boundaries. The crate only reaches the workspace through the Rust client's optional `fetch` feature via `solana-rpc-client` and `reqwest`, so this is a lockfile-only change with no manifest edits. --- Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3564160..f53b241 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1333,9 +1333,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.38" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69f9466fb2c14ea04357e91413efb882e2a6d4a406e625449bc0a5d360d53a21" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -1357,9 +1357,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.12" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",