flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

git agents cloudflare rust forge mcp

Upgrade rustls to 0.23.46 #39

Mergedsyntaqx merged g1t/security/rustls-0.23.46 into maindependenciesrust

Approved by syntaqx

Merged into main by syntaqx via a merge commit in 91a6731 yesterday

g1tbotopened this pull requestyesterday

Upgrades rustls (crates.io) from 0.23.45 to 0.23.46, which fixes these known vulnerabilities:

Advisory	Severity	Affected	Fixed in	Summary
GHSA-c8m5-c952-6cm4	medium	0.23.45	0.23.46	`Debug` impls for client session values expose TLS secrets
GHSA-vp88-798v-h67f	low	0.23.45	0.23.46	Buffered application data sent to outer server after ECH rejection
GHSA-h2v8-394m-p7vv	low	0.23.45	0.23.46	Brotli certificate decompression can allocate up to 1 GiB before authentication
GHSA-w44r-93j7-qv28	low	0.23.45	0.23.46	Unauthenticated ServerHello can downgrade later connections to classical key exchange

Lockfiles changed: Cargo.lock, apps/desktop/src-tauri/Cargo.lock.

Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.

Opened by g1t's security updates. Turn them off for this project on its Security page.

g1tbotrequested a review from syntaqx· yesterday

g1tbotadded the dependencies and rust labels· yesterday

syntaqxapproved these changes· yesterday

g1tbotcommentedyesterday

Dependency review

Passed. 4 dependency changes, none vulnerable.

Cargo.lock

Change	Package	Version	Relationship	License	Vulnerabilities
Added	`rustls`	0.23.46	direct	unknown	none known
Removed	`rustls`	0.23.45	direct	unknown

apps/desktop/src-tauri/Cargo.lock

Change	Package	Version	Relationship	License	Vulnerabilities
Added	`rustls`	0.23.46	transitive	unknown	none known
Removed	`rustls`	0.23.45	transitive	unknown

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

syntaqxmerged this· yesterday

All checks have passed

5 passed · on ea6ead2

Workflows

CI / pull_request / Rust7m 23sDetails

CI / pull_request / TypeScript4m 44sDetails

CI / pull_request / Build4m 49sDetails

CI / pull_request / Desktop app3m 19sDetails

Dependency review — 4 dependency changes, none vulnerableDetails

All checks have passed

2 passed · on ea6ead2

Workflows

CI / pull_request — CI passedDetails

Dependency review — 4 dependency changes, none vulnerableDetails

Merged and closed: the branch can be deleted safely

Everything on it is in its base now.