From 4cc4766f9ca1b6e830a2c41ba639aa02a7afb587 Mon Sep 17 00:00:00 2001 From: Vladimir Rotariu Date: Mon, 19 Oct 2026 11:47:38 -0600 Subject: [PATCH 1/2] fix(deps): bump rustls to 0.23.46 for RUSTSEC-2026-0346..0349 cargo audit fails on main since the four advisories were published, so every open pull request reads red on security-audit. rustls reaches the brain via reqwest (provider calls) and the daemon via sqlx-core (Postgres TLS). 0.23.46 is a patch release with security fixes and no API change. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UpyrhbDTW1gBwzGAC44GYU --- CHANGELOG.md | 8 ++++++++ Cargo.lock | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 98a6314a..37aaceae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,14 @@ Releases before `0.2.5` predate the public launch; their notes live in the ### Security +- **rustls moves to 0.23.46.** ([#PRNUM](https://github.com/lacs-project/sysknife/pull/PRNUM)) + RUSTSEC-2026-0346 to 0349 reached the brain through reqwest, which carries + provider calls, and the daemon through sqlx's Postgres TLS. The worst of the + four is `Debug` output that printed TLS session secrets. The others are a + key-exchange downgrade hint, a pre-authentication Brotli allocation that is + off by default, and early data sent after an ECH rejection. The patch release + changes no API. + - **Read tools stop forwarding credentials to the LLM provider.** ([#573](https://github.com/lacs-project/sysknife/pull/573)) A journal line carrying a password assignment or a `Bearer` token reached the provider in a diff --git a/Cargo.lock b/Cargo.lock index 89a9896a..d78bcc71 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4005,9 +4005,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell", From c5867841656885c3b9bbb1698d562fec6cb1b01e Mon Sep 17 00:00:00 2001 From: Vladimir Rotariu Date: Mon, 19 Oct 2026 12:00:46 -0600 Subject: [PATCH 2/2] docs(changelog): link #616 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UpyrhbDTW1gBwzGAC44GYU --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 37aaceae..378629a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,7 @@ Releases before `0.2.5` predate the public launch; their notes live in the ### Security -- **rustls moves to 0.23.46.** ([#PRNUM](https://github.com/lacs-project/sysknife/pull/PRNUM)) +- **rustls moves to 0.23.46.** ([#616](https://github.com/lacs-project/sysknife/pull/616)) RUSTSEC-2026-0346 to 0349 reached the brain through reqwest, which carries provider calls, and the daemon through sqlx's Postgres TLS. The worst of the four is `Debug` output that printed TLS session secrets. The others are a