This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/main by this push:
new 7db9b69d29 chore(deps): bump rustls to 0.23.46 to fix cargo audit
failures (#11562)
7db9b69d29 is described below
commit 7db9b69d29258d2a5cd545db819647b1cd210fac
Author: Andrew Lamb <[email protected]>
AuthorDate: Thu Oct 15 03:07:05 2026 +0000
chore(deps): bump rustls to 0.23.46 to fix cargo audit failures (#11562)
# Which issue does this PR close?
N/A
# Rationale for this change
The `audit` CI job is failing on main and on PRs (for example
https://github.com/apache/arrow-rs/actions/runs/38600959284/job/116002272430
on #11533) because four new RustSec advisories were published today
against `rustls`:
- [RUSTSEC-2026-0346](https://rustsec.org/advisories/RUSTSEC-2026-0346):
`Debug` impls for client session values expose TLS secrets
- [RUSTSEC-2026-0347](https://rustsec.org/advisories/RUSTSEC-2026-0347):
Buffered application data sent to outer server after ECH rejection
- [RUSTSEC-2026-0348](https://rustsec.org/advisories/RUSTSEC-2026-0348):
Brotli certificate decompression can allocate up to 1 GiB before
authentication
- [RUSTSEC-2026-0349](https://rustsec.org/advisories/RUSTSEC-2026-0349):
Unauthenticated ServerHello can downgrade later connections to classical
key exchange
All four are fixed in `rustls` 0.23.46.
# What changes are included in this PR?
`cargo update -p rustls`, which bumps `rustls` from 0.23.45 to 0.23.46
in `Cargo.lock`. No other changes.
# Are these changes tested?
I reproduced the failure locally with `cargo audit` on current main
(same four advisories), and confirmed `cargo audit` passes after this
change.
# Are there any user-facing changes?
No
Co-authored-by: Claude Fable 5.1 <[email protected]>
---
Cargo.lock | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 43432ea0ed..02eaa02e56 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3234,9 +3234,9 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
dependencies = [
"aws-lc-rs",
"log",
