[cipherstash-agent]

Summary

Patches rustls from 0.23.45 to 0.23.46 in every Cargo workspace that resolves it.

Advisories

All fixed in 0.23.46 (Dependabot alerts #258–#277 in https://github.com/cipherstash/stack/security/dependabot):

• GHSA-c8m5-c952-6cm4 (CVSS 4.0): affects < 0.23.46
• GHSA-h2v8-394m-p7vv (CVSS 3.7): affects < 0.23.46
• GHSA-w44r-93j7-qv28 (CVSS 3.7): affects < 0.23.46
• GHSA-vp88-798v-h67f (CVSS 2.3): affects >= 0.23.44, < 0.23.46

Versions

After this branch was cut, the Dependabot group bump 2a533ac00 moved rustls to 0.23.46 in three of the four workspaces on main. This PR makes the same change to those three files, so they merge cleanly and do not change main. The only real change is the fuzz lockfile.

Lockfile	main now	After merge
Cargo.lock	0.23.46	0.23.46 (no change)
languages/typescript/packages/protect-ffi/Cargo.lock	0.23.46	0.23.46 (no change)
packages/eql/Cargo.lock	0.23.46	0.23.46 (no change)
packages/stack-auth/fuzz/Cargo.lock	0.23.45	0.23.46

No other Cargo.lock in the repo resolves rustls: the two Go guests, ore_block_256/ctgen and the stack-encrypt and stack-kms fuzz crates do not.

Changes

cargo update -p rustls@0.23.45 --precise 0.23.46 in each workspace.
No other package moved, and no manifest changed (rustls 0.23.46 declares rust-version 1.71, below the repo's pinned toolchain).

No changeset: this changes only lockfiles.

Verification

• cargo metadata --locked passes in all four workspaces.
• deps.py over the branch: exit 0, no lockfile resolves a vulnerable rustls.
• CI passes, including the seven fuzz regression jobs that build packages/stack-auth/fuzz.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8272922

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 4

• Cargo.lock is excluded by !**/*.lock
• languages/typescript/packages/protect-ffi/Cargo.lock is excluded by !**/*.lock
• packages/eql/Cargo.lock is excluded by !**/*.lock
• packages/stack-auth/fuzz/Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6ebff7c8-580e-4280-838b-489d52f9e45b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cipherstash-agent]

Review attestation — automated /code-review medium + cross-check-review-findings, at head 8272922.

Result: no findings. No critical or blocking issues.

• Diff is 4 lockfiles, each changing only the rustls version (0.23.45 → 0.23.46) and its checksum.
• The new checksum 48e13bd8…c8fdf matches crates.io for rustls 0.23.46, which is not yanked. It is identical across all four lockfiles.
• No manifests or other packages moved. No changeset is needed for a lockfile-only change, so the changeset-bot warning can be ignored.
• No existing review threads to cross-check; the other comments are bot status only.

Not verified here: the full CI test run on the new version.

---

Generated by Claude Code

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

[freshtonic]

I updated the PR description. main already has rustls 0.23.46 in Cargo.lock, protect-ffi/Cargo.lock and packages/eql/Cargo.lock (Dependabot group bump 2a533ac00), so the only real change is now packages/stack-auth/fuzz/Cargo.lock. The Versions table now shows this.

The old description:

Summary

Patches rustls from 0.23.45 to 0.23.46 in the four Cargo workspaces that resolved it.

Advisories

All fixed in 0.23.46 (Dependabot alerts #258–#277 in https://github.com/cipherstash/stack/security/dependabot):

• GHSA-c8m5-c952-6cm4 (CVSS 4.0): affects < 0.23.46
• GHSA-h2v8-394m-p7vv (CVSS 3.7): affects < 0.23.46
• GHSA-w44r-93j7-qv28 (CVSS 3.7): affects < 0.23.46
• GHSA-vp88-798v-h67f (CVSS 2.3): affects >= 0.23.44, < 0.23.46

Versions

Lockfile	Before	After
Cargo.lock	0.23.45	0.23.46
languages/typescript/packages/protect-ffi/Cargo.lock	0.23.45	0.23.46
packages/eql/Cargo.lock	0.23.45	0.23.46
packages/stack-auth/fuzz/Cargo.lock	0.23.45	0.23.46

Changes

cargo update -p rustls@0.23.45 --precise 0.23.46 in each workspace.
No other package moved, and no manifest changed (rustls 0.23.46 declares rust-version 1.71, below the repo's pinned toolchain).

No changeset: this only changes lockfiles.

Verification

• cargo metadata --locked passes in all four workspaces.
• deps.py over the branch: exit 0, no lockfile resolves a vulnerable rustls.
• Only the four Cargo.lock files changed. CI runs the test suites.

---

Generated by Claude Code

[freshtonic]

Approved. The change is correct, and CI passes. After merge, packages/stack-auth/fuzz/Cargo.lock is the only lockfile that changes, because main already has the other three. I updated the description to show this.