[proggeramlug]

rustls 0.23.45 is affected by RUSTSEC-2026-0346 (TLS secrets in Debug impls), -0347 (buffered data sent after ECH rejection), -0348 (brotli certificate decompression allocates up to 1 GiB before authentication) and -0349 (unauthenticated ServerHello downgrades later connections to classical key exchange). 0.23.46 fixes all four. It was published 2026-10-14, inside the 7-day soak, so the lock was updated once with the owner-approved publish-age override (2026-10-16); Cargo.toml documents it next to the rustls dependency, and it lapses on 2026-10-21. Only Cargo.lock's rustls entry changes. cargo check --locked -p perry-stdlib -p perry-runtime passes. turnloop took the same update (PerryTS/turnloop#114).

Summary by CodeRabbit

• Documentation
  • Added internal documentation about the existing Rustls version and its security advisory status. No dependencies or product behavior changed.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c985c30e-421b-4bae-a75a-9f3330897d09

📥 Commits

Reviewing files that changed from the base of the PR and between b8026ce and e21d5ac.

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

• Cargo.toml

+-------------------------------------------------------+
| Cancel my subscriptions ... I'm tired of your issues. |
+-------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}