RUSTSEC-2026-0285, published 2026-09-14, affects rustls 0.23.43, which is what Cargo.lock on main resolves:
Crate: rustls
Version: 0.23.43
Title: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Severity: 5.3 (medium)
Solution: Upgrade to >=0.23.45
rustls reaches the binary through ureq, so it is in the path of every HTTPS call ferrflow makes: the bot token exchange, forge API calls, registry lookups.
Cargo Security runs cargo audit --deny warnings and is a required check, so every open pull request now fails it regardless of what it changes (first seen on #1064). main has not run CI since the advisory landed, which is why it still looks green.
The fix is a patch bump of rustls within the existing 0.23 constraint. cargo vet needs a matching update, since rustls is exempted at exactly 0.23.43 in supply-chain/config.toml and 0.23.45 is otherwise uncertified for a human-authored PR.
RUSTSEC-2026-0285, published 2026-09-14, affects
rustls0.23.43, which is whatCargo.lockonmainresolves:rustlsreaches the binary throughureq, so it is in the path of every HTTPS call ferrflow makes: the bot token exchange, forge API calls, registry lookups.Cargo Securityrunscargo audit --deny warningsand is a required check, so every open pull request now fails it regardless of what it changes (first seen on #1064).mainhas not run CI since the advisory landed, which is why it still looks green.The fix is a patch bump of
rustlswithin the existing0.23constraint.cargo vetneeds a matching update, sincerustlsis exempted at exactly0.23.43insupply-chain/config.tomland 0.23.45 is otherwise uncertified for a human-authored PR.