From c1aaaffce0992ce262251341fa2b6fdf67cf8250 Mon Sep 17 00:00:00 2001
From: piekstra <piekstra@users.noreply.github.com>
Date: Tue, 15 Sep 2026 13:59:40 -0400
Subject: [PATCH] fix(deps): rustls 0.23.45 (RUSTSEC-2026-0285)

rustls < 0.23.45 accepted TLS 1.3 handshake messages across encryption-level
boundaries (RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc, published 2026-09-14).
This repo's CI does not run cargo-audit, but the built binary carries the
vulnerable TLS stack. Lockfile-only bump (rustls + rustls-webpki); no manifest change.
---
 Cargo.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 978d0e8..cd334aa 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1793,9 +1793,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "once_cell",
  "ring",
@@ -1817,9 +1817,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",