From e1c150f806aefadef3764ff2c42be7cedfdf1ce5 Mon Sep 17 00:00:00 2001 From: Loris Leiva Date: Fri, 16 Oct 2026 10:37:49 +0100 Subject: [PATCH] Update rustls to fix cargo audit This PR fixes the red Audit job on main by bumping `rustls` to 0.23.46 in the lockfile, which resolves four new RustSec vulnerabilities (RUSTSEC-2026-0346 to 0349) in transitive dependencies of the `solana-client` stack. It also removes the one stale `--ignore` flags (RUSTSEC-2024-0376) from `make audit`, since none of those advisories fire any more. Keeping them would not save us future work. Because `Cargo.lock` is checked in, an advisory only comes back if we reintroduce a vulnerable version, for example through a downgrade or a new dependency pulling in an older major line. When that happens we want CI to flag it, rather than have a stale ignore quietly let it through. If one does come back and can't be bumped, we can re-add the ignore with a comment explaining why. The remaining ignores still fire on old major lines with no compatible patch. --- Cargo.lock | 4 ++-- Makefile | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7d8ab9ff..eb1ff009 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4339,9 +4339,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "once_cell", "ring", diff --git a/Makefile b/Makefile index 1c2cddf1..353eb645 100644 --- a/Makefile +++ b/Makefile @@ -24,7 +24,7 @@ audit: cargo audit \ --ignore RUSTSEC-2022-0093 \ --ignore RUSTSEC-2024-0344 \ - --ignore RUSTSEC-2024-0376 $(ARGS) + $(ARGS) spellcheck: cargo spellcheck --code 1 $(ARGS)