alamb opened a new pull request, #11562: URL: https://github.com/apache/arrow-rs/pull/11562
# Which issue does this PR close? N/A # Rationale for this change The `audit` CI job is failing on main and on PRs (for example https://github.com/apache/arrow-rs/actions/runs/38600959284/job/116002272430 on #11533) because four new RustSec advisories were published today against `rustls` 0.23.45, which is pinned in `Cargo.lock`: - [RUSTSEC-2026-0346](https://rustsec.org/advisories/RUSTSEC-2026-0346): `Debug` impls for client session values expose TLS secrets - [RUSTSEC-2026-0347](https://rustsec.org/advisories/RUSTSEC-2026-0347): Buffered application data sent to outer server after ECH rejection - [RUSTSEC-2026-0348](https://rustsec.org/advisories/RUSTSEC-2026-0348): Brotli certificate decompression can allocate up to 1 GiB before authentication - [RUSTSEC-2026-0349](https://rustsec.org/advisories/RUSTSEC-2026-0349): Unauthenticated ServerHello can downgrade later connections to classical key exchange All four are fixed in `rustls` 0.23.46. # What changes are included in this PR? `cargo update -p rustls`, which bumps `rustls` from 0.23.45 to 0.23.46 in `Cargo.lock`. No other changes. # Are these changes tested? I reproduced the failure locally with `cargo audit` on current main (same four advisories), and confirmed `cargo audit` passes after this change. # Are there any user-facing changes? No -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
