fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285

[WomB0ComB0]

What

cargo update -p rustls --precise 0.23.45. Lockfile only — no manifest change.

Why

scan / osv-scanner fails on main and therefore on every PR branched from it:

Total 1 package affected by 1 known vulnerability (0 Critical, 0 High, 1 Medium, 0 Low)
| https://osv.dev/RUSTSEC-2026-0285 | 5.3 | crates.io | rustls | 0.23.37 | 0.23.45 | Cargo.lock |
##[error]Process completed with exit code 1

RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc: rustls accepted TLS 1.3 handshake
messages sent at the wrong encryption level when they followed a key-changing
message in the same record (e.g. a plaintext EncryptedExtensions packed into
the ServerHello record). RFC 8446 §5.1 requires the connection be terminated
with unexpected_message. The transcript stays authenticated, so this is not a
handshake-forgery path; severity is 5.3. Fixed in 0.23.45.

osv-scanner.toml deliberately suppresses 11 advisories that have no reachable
fix. This one does have a released fix, so it is bumped, not added to the
filter file.

Where rustls comes from

cargo tree -e normal -i rustls prints nothing to print — rustls is not in
the on-chain dependency graph. Every path is dev-only, through the vendored
solana-program-test dev-dependency of both program crates:

rustls v0.23.45
├── anza-quinn -> solana-client -> solana-banks-server -> solana-program-test
│                                    [dev-dependencies] -> resq-delivery / resq-airspace
├── hyper-rustls -> reqwest -> reqwest-middleware -> solana-rpc-client -> ...
├── rustls-platform-verifier -> anza-quinn-proto
├── solana-quic-client / solana-streamer / solana-tls-utils / solana-tpu-client-next
└── tokio-rustls -> tokio-tungstenite -> solana-pubsub-client

So the exposure was host-side test tooling, not the deployed BPF programs. It
still has to be fixed because osv-scanner gates CI on it.

Blast radius

Two lock entries, 4 insertions / 4 deletions, package count unchanged at 796:

package	before	after
rustls	0.23.37	0.23.45
rustls-webpki	0.103.13	0.103.15

rustls-webpki moves because rustls 0.23.45 declares rustls-webpki = "0.103.14"
and the lock held 0.103.13. Nothing else in the graph shifted.

Verification

Ran the exact scanner and version the reusable security-scan.yml job runs
(osv-scanner v2.3.5, scan source --recursive ./):

Before — exit 1:

Filtered 11 vulnerabilities from output
Total 1 package affected by 1 known vulnerability (0 Critical, 0 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
| https://osv.dev/RUSTSEC-2026-0285 | 5.3 | crates.io | rustls | 0.23.37 | 0.23.45 | Cargo.lock |

After — exit 0:

Filtered 5 ignored package/s from the scan.
Filtered 11 vulnerabilities from output
No issues found

Same 11 filtered advisories and 5 filtered packages as before; no new advisory
surfaced.

Build and tests, on the host toolchain (stable 1.95.0), not an SBF build:

• cargo metadata --format-version 1 --locked → exit 0
• cargo check --workspace --all-targets --locked → exit 0 (compiles the whole
  dev tree, including the rustls consumers solana-quic-client, solana-client
  and solana-program-test)
• cargo test --workspace --locked → exit 0, all tests pass

A cargo build-sbf was not run; rustls is absent from the on-chain graph, so
the SBF artifact is unaffected by this lock change.

Note

PR #72 (a README fix) is currently red purely because of this — scan / osv-scanner is its only failing check, everything else passes. It should go
green once this merges and it picks up main.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c03385f1-3e5b-4f33-90bd-8ec956778032

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

AI Auditor: Audit Passed

The security audit for this pull request has passed.

Summary

• Security Fix: Correctly addresses [RUSTSEC-2026-0285]((osv.dev/redacted) by bumping rustls from 0.23.37 to 0.23.45.
• Dependency Integrity: rustls-webpki was updated to 0.103.15, satisfying the updated requirements of rustls.
• Scope: The changes are limited to Cargo.lock. Static analysis confirms that all workspace dependencies are now consolidated on the fixed rustls version.
• Verification: The update is surgical and follows the recommended fix path for the reported advisory.

No security vulnerabilities, logic bugs, or performance issues were identified.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #73 · ◷