[cipherstash-agent]

Summary

Patches rustls from 0.23.45 to 0.23.46 in the four Cargo workspaces that resolved it.

Advisories

All fixed in 0.23.46 (Dependabot alerts #258–#277 in https://github.com/cipherstash/stack/security/dependabot):

• GHSA-c8m5-c952-6cm4 (CVSS 4.0): affects < 0.23.46
• GHSA-h2v8-394m-p7vv (CVSS 3.7): affects < 0.23.46
• GHSA-w44r-93j7-qv28 (CVSS 3.7): affects < 0.23.46
• GHSA-vp88-798v-h67f (CVSS 2.3): affects >= 0.23.44, < 0.23.46

Versions

Lockfile	Before	After
Cargo.lock	0.23.45	0.23.46
languages/typescript/packages/protect-ffi/Cargo.lock	0.23.45	0.23.46
packages/eql/Cargo.lock	0.23.45	0.23.46
packages/stack-auth/fuzz/Cargo.lock	0.23.45	0.23.46

Changes

cargo update -p rustls@0.23.45 --precise 0.23.46 in each workspace.
No other package moved, and no manifest changed (rustls 0.23.46 declares rust-version 1.71, below the repo's pinned toolchain).

No changeset: this only changes lockfiles.

Verification

• cargo metadata --locked passes in all four workspaces.
• deps.py over the branch: exit 0, no lockfile resolves a vulnerable rustls.
• Only the four Cargo.lock files changed. CI runs the test suites.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8272922

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 4

• Cargo.lock is excluded by !**/*.lock
• languages/typescript/packages/protect-ffi/Cargo.lock is excluded by !**/*.lock
• packages/eql/Cargo.lock is excluded by !**/*.lock
• packages/stack-auth/fuzz/Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6ebff7c8-580e-4280-838b-489d52f9e45b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cipherstash-agent]

Review attestation — automated /code-review medium + cross-check-review-findings, at head 8272922.

Result: no findings. No critical or blocking issues.

• Diff is 4 lockfiles, each changing only the rustls version (0.23.45 → 0.23.46) and its checksum.
• The new checksum 48e13bd8…c8fdf matches crates.io for rustls 0.23.46, which is not yanked. It is identical across all four lockfiles.
• No manifests or other packages moved. No changeset is needed for a lockfile-only change, so the changeset-bot warning can be ignored.
• No existing review threads to cross-check; the other comments are bot status only.

Not verified here: the full CI test run on the new version.

---

Generated by Claude Code

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.