[loganj]

🤖

Summary

The required Security check now fails on every branch, including main. The dependency audit (cargo-deny) reports two new advisories for rustls 0.23.45, the TLS library behind the relay, CLI and desktop connections:

• RUSTSEC-2026-0346: printing a TLS client session value with Debug (for example, in a log line) shows its TLS secret.
• RUSTSEC-2026-0347: when a server rejects Encrypted Client Hello (ECH, which hides the server name a client asks for), data the client buffered can go to the outer server.

rustls 0.23.46 fixes both. This PR moves the root and desktop lockfiles to it, so the Security check passes again.

Related issue

None found. #8277 fixed an earlier advisory in the same way.

Testing

• cargo-deny check passes: "advisories ok, bans ok, licenses ok, sources ok".
• cargo tree --locked resolves both lockfiles without more changes. Only the rustls version and checksum change. A plain cargo update -p rustls also moved unrelated syn and getrandom edges, so this PR leaves those out.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: d25384a4f3c3a940b5b999f26105091c58ab76d6...b2172bbe63fe890e8c267ac8066cee14577e4327
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

The authorized range only updates rustls from 0.23.45 to 0.23.46 in both lockfiles, with matching checksums and unchanged dependency lists. No concrete security, correctness, or reliability findings were identified.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only inspection. Upstream rustls changes and registry checksums were not independently verified; no network access, builds, or tests were used.

---

_{Generated by Codex Security Review |
Requested by: @loganj |
Workflow run}