Skip to content

fix(deps): bump rustls to 0.23.46 - #117

Open
junhsss wants to merge 1 commit into
mainfrom
jun/bump-rustls
Open

junhsss wants to merge 1 commit into
mainfrom
jun/bump-rustls

Conversation

@junhsss

@junhsss junhsss commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

rustls 0.23.37 has four new advisories: RUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348 and RUSTSEC-2026-0349. This bumps rustls to 0.23.46 and rustls-webpki to 0.103.15. Lockfile only.

cargo deny check still fails after this, on main as well:

  • zip 8.5.1 has three advisories (RUSTSEC-2026-0367, RUSTSEC-2026-0368, RUSTSEC-2026-0369). They need zip 9. steel forge calls ZipArchive::extract on a downloaded template, so this one matters. agent-browser also pins zip 8.
  • unsafe-libyaml, pulled in by serde_yaml for forge recipes, is flagged unmaintained (RUSTSEC-2024-0449).

Those need their own changes.

馃 Generated with Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant