chore: update rustls 0.23.37 → 0.23.45 to resolve RUSTSEC-2026-0285

[beardthelion]

Summary

Bumps rustls 0.23.37 to 0.23.45 to resolve RUSTSEC-2026-0285 (TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries, severity medium 5.3). The advisory landed 2026-09-14 and the cargo audit job now fails on every open PR.

Motivation & context

Closes #454

Kind of change

• Bug fix
• Feature
• Security fix
• Docs
• Tests / CI
• Refactor (no behavior change)
• Breaking or protocol change (issue required first)

What changed

• Cargo.lock only. rustls 0.23.37 -> 0.23.45, with the companion bumps cargo resolved alongside it: aws-lc-rs 1.16.2 -> 1.18.1, aws-lc-sys 0.39.0 -> 0.45.0, rustls-webpki 0.103.13 -> 0.103.15.

How a reviewer can verify

cargo audit

Exits clean locally: 0 vulnerabilities, the same 11 allowed warnings as before.

Before you request review

• Scope is one logical change; no unrelated churn
• cargo test --workspace passes locally
• New behavior is covered by tests (required for fixes)
• cargo fmt --all and cargo clippy --workspace --all-targets -- -D warnings are clean
• Commit titles use Conventional Commits (feat(...), fix(...), docs(...))
• Docs / .env.example updated if behavior or config changed (or N/A)
• Checked existing PRs so this isn't a duplicate

Protocol & signing impact

• Touches DID / did:key, Ed25519 / RFC 9421 signatures, UCAN, ref certs, or P2P wire formats
• Discussed in an issue before implementation
• Backward-compatible with existing nodes and previously signed history

Notes for reviewers

Lockfile-only change, no code touched, so there is no new behavior to cover with a test. The workspace test box is unchecked because the suite runs in CI; fmt and clippy passed through the pre-push gate. Expect mechanical Cargo.lock conflicts with the dep-adding PRs and with release-please #307; whichever lands first, the other regenerates with cargo update -p rustls or a rebase.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: 54d558be-82ec-407d-95d0-81d552c3081f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[jatmn]

LGTM

[euxaristia]

Verified lockfile-only: rustls 0.23.37 to 0.23.45 plus the lockfile-mandated companions, no manifest or feature changes, tests correctly deferred to CI. Unblocks the cargo-audit gate every other PR is red on.