Repository navigation
docs: record rustls security update validation - #2313
Merged
Merged
Conversation
Update the lockfile-only rustls resolution to 0.23.46, the patched release for the four RustSec advisories, without changing manifests, features, providers, or APIs. Validated with cargo-deny, locked metadata, the locked rustls dependency tree, and git diff --check. Focused TLS and downloader tests were not run because this isolated worktree has no build cache and the primary worktree is running release builds.
inureyes
added
status:review
inureyes
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Preserve the English/Korean assessment and validation reports for the rustls 0.23.46 security update. The dependency fix already landed through #2304; after integrating current main, this PR changes only the reports, not product code or dependency resolution.
The original lock-only patch was independently reviewed against all four RustSec advisories and the canonical crate checksum. The ring-only provider qualification remains explicit: no product-level post-quantum protection or loss is claimed.
Validation of the original patch at
e9604cba: cargo-deny, locked metadata/dependency tree, 10 TLS tests, and 71 downloader tests passed; one optional integration test was ignored. Tests used the supportedMLXCEL_BUILD_METAL=OFFCPU configuration because that historical base had an unrelated Xcode 27 Metal compilation failure. Live external TLS integration was not exercised. These are not fresh whole-product tests on the newer MLX pin.The original WebUI performance check missed its threshold (2.075% degradation versus 2% limit); it is preserved as historical evidence, not relabeled as a pass. The final diff is documentation-only and does not modify or weaken that gate.
Closes #2312