fix(deps): rustls 0.23.45 in every live lockfile — RUSTSEC-2026-0285 - #887
Merged
Merged
Conversation
RUSTSEC-2026-0285 (published 2026-09-14, severity 5.3): rustls accepted TLS 1.3 handshake messages across encryption-level boundaries; fixed in 0.23.45. CI's Security audit (Rust gates) fails on it, first seen on #886. Four lockfiles resolve rustls, and all four are live: - Cargo.lock (repo root): the CI audit and workspace build. - dsm_client/deterministic_state_machine/Cargo.lock: that directory is its own workspace root; `make android-libs` and the test board build from it. - crates/dsm-android-anchor/Cargo.lock: the shipped Android cdylib (build.gradle.kts), which links dsm_sdk statically. - crates/dsm-anchor-hw-verifier/Cargo.lock. Each was updated with `cargo update -p rustls@<old> --precise 0.23.45` and each diff is the same four packages: rustls, rustls-webpki 0.103.15, aws-lc-rs 1.18.1, aws-lc-sys 0.45.0.
cryptskii
added a commit
that referenced
this pull request
Sep 14, 2026
…d lock (#889) The security audit read only the root Cargo.lock. The nested dsm_client workspace lock (the test board and make android-libs) and the dsm-android-anchor lock (the shipped Android library) carried advisories it never saw: RUSTSEC-2026-0285, fixed in #887, and RUSTSEC-2026-0185. ci/audit_every_lockfile.sh audits every lockfile git tracks, reports all failures before exiting, and refuses an empty list. The CI and release security audits, make audit and make release-preflight call it. The nested lock moves quinn-proto 0.11.14 to 0.11.15 so the widened gate starts green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
RUSTSEC-2026-0285 (published 2026-09-14, severity 5.3 medium): rustls accepted TLS 1.3 handshake messages across encryption-level boundaries. Fixed in rustls 0.23.45. CI's Rust gates → Security audit step fails on it (first seen on #886;
main's next run fails the same way).Four lockfiles, all live, all bumped
Cargo.lock(root)cargo auditand the workspace builddsm_client/deterministic_state_machine/Cargo.lockmake android-libsand the test board build from itcrates/dsm-android-anchor/Cargo.lockbuild.gradle.kts:300), linksdsm_sdkstaticallycrates/dsm-anchor-hw-verifier/Cargo.lockEach was updated with
cargo update -p rustls@<old> --precise 0.23.45. Every diff is exactly the same four packages:rustls→ 0.23.45,rustls-webpki→ 0.103.15,aws-lc-rs→ 1.18.1,aws-lc-sys→ 0.45.0. Nothing else moved.Verification
cargo auditat the repo root, the CI gate: 0 vulnerabilities, and the same 3 allowed warnings CI already tolerates (lruunsound,chacha20andspinyanked). The same command onorigin/main's lock reproduces the RUSTSEC-2026-0285 error.cargo audit -fon both anchor locks: 0 vulnerabilities.cargo check --locked -p dsm_sdk -p dsm_storage_node(root) andcargo check --locked -p dsm_sdk(nested workspace) both finish. That includes running the newaws-lc-sys0.45 build script.dsm-android-anchorcdylib against the new lock (cargo ndk -t arm64-v8a build --release --locked --features on_device_installs): finishes. The log showsaws-lc-sys v0.45.0andrustls v0.23.45compiling foraarch64-linux-android, andlibdsm_android_anchor.sois produced. The C-building dependency that moved cross-compiles on the path the APK ships.Not in this PR
The nested workspace lock also carries an older, unrelated advisory: quinn-proto 0.11.14, RUSTSEC-2026-0185 (high). The root lock is already on 0.11.15. CI never audits the nested lock. Filed as a separate task.
After this merges, #886 needs a rebase onto
mainto pick up the fixed root lock.The two anchor locks resolve a path dependency at
../../../../libtropic-rs(outside the repo), so updating them requires that checkout.