Repository navigation
Conversation
Addresses GHSA-2mjx-qc3c-rqvc (RUSTSEC-2026-0285) in all four Cargo.lock files. rustls 0.23.45 requires aws-lc-rs ^1.18 and rustls-webpki ^0.103.14, so those move too where needed.
🦋 Changeset detectedLatest commit: 457b28e The changes in this PR will be included in the next version bump. This PR includes changesets to release 26 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: updating rustls to version 0.23.45 to address the dependency vulnerability. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Mutation testing (cargo-mutants,
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 49314ad9dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Review of 49314ad. I do not repeat the two open Codex points about changesets for @cipherstash/protect-ffi and @cipherstash/auth. They are still open.
What I checked
- Advisory. GHSA-2mjx-qc3c-rqvc names
>= 0.23.13, < 0.23.45, first patched0.23.45. The PR pins0.23.45. Correct. - Coverage. I read every tracked
Cargo.lockonmain. Only four carryrustls: the root,protect-ffi,packages/eqlandpackages/stack-auth/fuzz. The PR moves all four to0.23.45. The two Go guests and thestack-encryptandstack-kmsfuzz crates do not carryrustls. Coverage is complete. - Lock consistency.
cargo metadata --lockedpasses in all four workspaces on the PR head (Rust 1.94.1). - Dependabot overlap.
- #1196 and #1155 merge with no conflict. After each merge,
cargo metadata --lockedstill passes in all four workspaces, andrustlsstays at0.23.45. - #1154 has a text conflict in
languages/typescript/packages/protect-ffi/Cargo.lock. GitHub blocks that merge, so it is safe. The PR that merges second must regenerate the lock. After that, make sure thatrustlsis still0.23.45. - None of the three Dependabot PRs changes
rustls,rustls-webpkioraws-lc-*.
- #1196 and #1155 merge with no conflict. After each merge,
- CI. 58 checks pass and 2 skip (the nightly fuzz campaign and
review). No failures.
Before merge (recommended, not blocking)
aws-lc-sys moves from 0.44.0 to 0.45.0 in protect-ffi and gains a pkg-config build dependency. No PR job compiles the six release platforms. The zigbuild glibc 2.28 target and the Alpine musl container in _build-ffi-artifacts.yml (lines 197-252) are the jobs most likely to break on a changed C build script. Dispatch ffi-preflight.yml with ref: fix/cip-4891-rustls before you merge. If you do not, the first proof comes from the release run.
Add patch changesets for @cipherstash/protect-ffi (and its six platform packages) and @cipherstash/auth, so the lockfile bump to rustls 0.23.45 (GHSA-2mjx-qc3c-rqvc) ships in its own release rather than depending on unrelated pending changesets. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FboWTTDJN1UFUDUzSzHzNH
This branch has not been deployed
3 participants
Patches
rustlsto 0.23.45 to address GHSA-2mjx-qc3c-rqvc (RUSTSEC-2026-0285; affects >= 0.23.13, < 0.23.45).Lockfile-only change via
cargo update -p rustls --precise 0.23.45in each workspace:Cargo.lockpackages/eql/Cargo.locklanguages/typescript/packages/protect-ffi/Cargo.lockpackages/stack-auth/fuzz/Cargo.lockRequired transitive bumps (rustls 0.23.45 needs
rustls-webpki ^0.103.14andaws-lc-rs ^1.18):rustls-webpki0.103.13 -> 0.103.15 (all four)aws-lc-rs-> 1.18.1 andaws-lc-sys-> 0.45.0 (eql, protect-ffi; protect-ffi also gainspkg-configas an aws-lc-sys build dep)Resolves Dependabot alerts #230, #234, #235, #239.
Verified locally with
cargo check --locked(Rust 1.94.1) in all four workspaces.Summary by CodeRabbit