From e47cb0a5e48b5a380c501eeac0ed7ec2920657f5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 24 Nov 2025 20:12:09 +0000
Subject: [PATCH] build(deps): bump rustls from 0.23.31 to 0.23.34 in /rust
(#10954)
Bumps [rustls](https://github.com/rustls/rustls) from 0.23.31 to
0.23.34.
Commits
4cee226
Cargo: rustls v0.23.33 -> v0.23.34
278391e
Remove use of doc_auto_cfg
31ca6af
Avoid use of docsrs cfg
b4597ca
Prepare 0.23.33
667a71d
Reset KeyUpdate counter on AppData
48b2fd9
Support encryption for QUIC multipath
6a188a7
Take semver-compatible updates
5abe33e
Prepare 0.23.32
d3c502e
Improve compatibility of TLS1.2 with ECDSA+SHA512
ef7063d
take webpki 0.103.5
- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
rust/Cargo.lock | 8 ++++----
rust/Cargo.toml | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 00f2d95cc..b64a3f42c 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -6316,9 +6316,9 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.31"
+version = "0.23.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
dependencies = [
"log",
"once_cell",
@@ -6362,9 +6362,9 @@ dependencies = [
[[package]]
name = "rustls-webpki"
-version = "0.103.4"
+version = "0.103.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc"
+checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
dependencies = [
"ring",
"rustls-pki-types",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 4032bfb77..857676185 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -152,7 +152,7 @@ ringbuffer = "0.16.0"
roxmltree = "0.21"
rpassword = "7.4.0"
rtnetlink = { version = "0.18.1", default-features = false, features = ["tokio_socket"] }
-rustls = { version = "0.23.31", default-features = false, features = ["ring"] }
+rustls = { version = "0.23.34", default-features = false, features = ["ring"] }
rustls-pki-types = "1.13.0"
sadness-generator = "0.6.0"
sd-notify = "0.4.5" # This is a pure Rust re-implementation, so it isn't vulnerable to CVE-2024-3094