chore(deps): update rust crate rustls to v0.23.45 [security]

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
rustls	dependencies	patch	0.23.44 → 0.23.45

---

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

GHSA-2mjx-qc3c-rqvc / RUSTSEC-2026-0285

More information

Details

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext EncryptedExtensions message packed into the same record as the
ServerHello was accepted.

RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.

The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.

This is functionally the same bug as Go's
GO-2026-4340 (CVE-2025-61730).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://crates.io/crates/rustls
• https://rustsec.org/advisories/RUSTSEC-2026-0285.html
• https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}