This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-11562-e518fe2a0adf2d96a9d67f11b2d6a8b673a93191 in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
commit 8dff89dbfed32b15115854e816c8e83f69f08226 Author: Andrew Lamb <[email protected]> AuthorDate: Wed Oct 14 22:30:54 2026 +0000 chore(deps): bump rustls to 0.23.46 to fix cargo audit failures (#11562) # Which issue does this PR close? N/A # Rationale for this change The `audit` CI job is failing on main and on PRs (for example https://github.com/apache/arrow-rs/actions/runs/38600959284/job/116002272430 on #11533) because four new RustSec advisories were published today against `rustls`: - [RUSTSEC-2026-0346](https://rustsec.org/advisories/RUSTSEC-2026-0346): `Debug` impls for client session values expose TLS secrets - [RUSTSEC-2026-0347](https://rustsec.org/advisories/RUSTSEC-2026-0347): Buffered application data sent to outer server after ECH rejection - [RUSTSEC-2026-0348](https://rustsec.org/advisories/RUSTSEC-2026-0348): Brotli certificate decompression can allocate up to 1 GiB before authentication - [RUSTSEC-2026-0349](https://rustsec.org/advisories/RUSTSEC-2026-0349): Unauthenticated ServerHello can downgrade later connections to classical key exchange All four are fixed in `rustls` 0.23.46. # What changes are included in this PR? `cargo update -p rustls`, which bumps `rustls` from 0.23.45 to 0.23.46 in `Cargo.lock`. No other changes. # Are these changes tested? I reproduced the failure locally with `cargo audit` on current main (same four advisories), and confirmed `cargo audit` passes after this change. # Are there any user-facing changes? No Co-authored-by: Claude Fable 5.1 <[email protected]> --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 43432ea0ed..02eaa02e56 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3234,9 +3234,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log",
