fix(deps): patch the rustls TLS 1.3 advisory (RUSTSEC-2026-0285) - #728
Merged
Merged
Conversation
rustls 0.23.42 → 0.23.45
TLS 1.3 handshake messages incorrectly accepted across encryption
level boundaries
1.1.0 shipped with this. It reaches us through the updater's HTTPS client and
through sqlx's TLS, so it is on the path that fetches releases and the path
that talks to a server over TLS.
0.23.45 is the minimum patched release and is nine days old, so it clears the
seven-day publish-age rule this project holds dependencies to.
Worth recording how this was nearly missed twice.
It surfaced on a dependabot PR, and my first instinct was that the bump had
introduced it — main looked clean when I checked. It was not clean. Two
separate things hid it:
`scripts/cargo-audit-check.sh` needs `jq`, and in an environment without it the
parse fails, the failure is printed but not fatal, and the script exits 0. A
gate that reports success when it could not read its input is worse than no
gate, because it is believed. That is not CI's problem — CI has jq — but it is
anyone's problem who runs the script locally, which is what it is for.
And `cargo audit` uses a cached advisory database. Mine was stale, so even a
working parse would have said clean. The advisory was published after my last
fetch.
So the first reading was wrong in the usual direction: the new thing looked
guilty and the old thing looked fine. Checking main with a fresh database is
what settled it.
This was referenced Sep 23, 2026
Merged
EVWorth
added a commit
that referenced
this pull request
Oct 5, 2026
Version bump across the three manifests and the two lockfile entries that record the app's own version. What 1.2.0 contains since 1.1.0: - Each editor tab runs on its own server session, so SET @var, temporary tables and multi-run transactions carry across runs (#734) - Separate connection lanes for the agent and for backups/restores, so neither can starve the editor; the pool-exhausted message says what is holding the pool (#732, #727) - Copy button beside Expand for long cell values, such as SHOW CREATE TABLE (#748) - Linux/Wayland: WebKitGTK's DMABUF renderer is turned off, for the black area left after resizing the window (#742) - Tauri 2.12 on both the npm and Rust sides (#749), and the dependency roll-up in #740 - rustls TLS 1.3 advisory RUSTSEC-2026-0285 patched (#728) Also the first release built with rustup in place of dtolnay/rust-toolchain (#746), so the release jobs' toolchain step runs on Windows and macOS for the first time. Claude-Session: https://claude.ai/code/session_01SCNjpC4VgppHSFs7P6rkZg Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.1.0 shipped with this. rustls reaches us through the updater's HTTPS
client and through sqlx's TLS — so it's on the path that fetches releases and
the path that talks to a database over TLS.
0.23.45is the minimum patched release and is 9 days old, clearing theseven-day publish-age rule.
After: the rustls advisory is gone. The two remaining are the quick-xml pair
already on the known-accepted list, blocked on a wayland-rs release (#206).
How this was nearly missed, twice
It surfaced on dependabot PR #725, and my first instinct was that the bump had
introduced it — main looked clean when I checked. It wasn't. Two separate
things hid it:
scripts/cargo-audit-check.shneedsjq. Without it the parse fails, thefailure is printed, and the script still exits 0. A gate that reports
success when it couldn't read its input is worse than no gate, because it gets
believed. CI has jq so CI was right all along — but the script exists to be run
locally, which is precisely where this bites.
cargo audituses a cached advisory database. Mine was stale, so even aworking parse would have said clean. The advisory postdates my last fetch.
So the first reading was wrong in the usual direction: the new thing looked
guilty, the old thing looked fine. Re-checking main with a fresh database is
what settled it.
I'd suggest a follow-up to make that script fail loudly when
jqis missing —filing separately rather than widening this one.
Verification
cargo audit: 0 hits for RUSTSEC-2026-0285cargo clippy --workspace --all-targets --all-featurescleanjust test-rustgreen🤖 Generated with Claude Code