chore(deps): update rust crate rustls to v0.23.45 [security]

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
rustls	workspace.dependencies	patch	0.23.44 → 0.23.45

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

GHSA-2mjx-qc3c-rqvc / RUSTSEC-2026-0285

More information

Details

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext EncryptedExtensions message packed into the same record as the
ServerHello was accepted.

RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.

The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.

This is functionally the same bug as Go's
GO-2026-4340 (CVE-2025-61730).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://crates.io/crates/rustls
• https://rustsec.org/advisories/RUSTSEC-2026-0285.html
• https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

What changed: patch bump, rustls 0.23.44 → 0.23.45, fixing GHSA-2mjx-qc3c-rqvc / RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across the wrong encryption-level boundary). The fix makes rustls stricter about rejecting misplaced handshake messages; it doesn't remove or change any public API, and as a patch release it carries no other behavioral changes worth flagging.

What breaks here: nothing. Only Cargo.lock changed (no Cargo.toml edit), so this repo doesn't pin any API surface affected by the fix. The lockfile diff also bumps transitive windows-sys (0.52.0 → 0.61.2) for a handful of unrelated crates (rustix, getrandom, etc.) as a side effect of the cargo update; that's a build-time dependency only and not something this repo calls directly.

CI: at review time most jobs (Check, Coverage, git-lfs integration matrix, etc.) were still queued/in-progress, but everything that had completed (osv-scanner, gitleaks, snyk, Helm chart, Conventional commits) passed. Nothing failed.

Uneventful security patch, safe to merge.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}