fix(forestage): update rustls to 0.23.45 for RUSTSEC-2026-0285

[arcaven]

Cargo Deny on develop fails on RUSTSEC-2026-0285 (low severity), and that failure is holding forestage#119. This moves rustls out of the affected range so the check passes again.

The advisory covers rustls 0.23.13 through 0.23.44; patched is 0.23.45 or later. forestage resolved 0.23.37 through reqwest 0.12 (rustls-tls). cargo update -p rustls takes it to 0.23.45; rustls-webpki moves 0.103.13 to 0.103.15 with it. Lockfile only, no Cargo.toml change.

Checked locally on this branch: cargo deny check reports advisories, bans, licenses and sources ok; cargo check --locked finishes. The remaining warning (RUSTSEC-2026-0009 in the ignore list matched no crate) was already there and is left alone.

Refs #121
Refs: forestage#119

[arcavenai]

APPROVE at bc4a973.

Lead with why

The opener: "Cargo Deny on develop fails on RUSTSEC-2026-0285 (low severity), and that failure is holding forestage#119. This moves rustls out of the affected range so the check passes again."

(a) Present. (b) It matches a lockfile-only bump. forestage#121, the tracking issue, is open with the same symptom.

(1) The advisory

rustsec/advisory-db crates/rustls/RUSTSEC-2026-0285.md reads:

• package = "rustls", date = "2026-09-14", cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" (low);
• patched = [">= 0.23.45"], unaffected = ["< 0.23.13"];
• title: "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries". The handshake transcript stays authenticated, so the effect is accepting plaintext messages that should be encrypted.

0.23.37 is inside the affected range and 0.23.45 is the first patched version, which matches the body.

(2) The lock diff: exactly two crates, with crates.io checksums

git diff origin/develop...head touches only Cargo.lock, +4/-4: the version and checksum lines of rustls and rustls-webpki. No dependency list changed, and no other package moved.

Crate	Lock checksum	crates.io /api/v1/crates/<c>/<v> checksum
rustls 0.23.45	0d41d731...048d634	0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634 (published 2026-09-14, not yanked)
rustls-webpki 0.103.15	f3c3cf1d...b60ac2	f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2 (published 2026-08-21, not yanked)

Both match byte for byte. There is one name = "rustls" entry in the lock, so there is no second copy left on the old version.

(3) Deny, build and tests

I ran these in scratch worktrees (since removed) with cargo-deny 0.19.9 and a separate CARGO_TARGET_DIR:

• Head: cargo deny --locked check gives advisories ok, bans ok, licenses ok, sources ok, rc 0.
• develop 9fc9f69: advisories FAILED, with error[vulnerability] for ID: RUSTSEC-2026-0285, rc 1. That is the control.
• The duplicate-crate warnings are the same 13 on both, so nothing new.
• cargo build --locked at the head finishes, rc 0.
• cargo test --locked: 161 passed, 5 passed, and two empty suites. 0 failed, rc 0.

(4) The RUSTSEC-2026-0009 ignore: pre-existing

deny.toml:7 has "RUSTSEC-2026-0009" on develop too, added in 21f3920 (2026-04-10, "fix(aclaude): cargo deny issues ..."). Both runs print warning[advisory-not-detected]: advisory was not encountered for it. It is unchanged here and out of scope. It could be removed in a later cleanup.

(5) rustls-webpki 0.103.15

• Advisories. crates/rustls-webpki/ in advisory-db holds five. Each one's patched range includes 0.103.15:
  • RUSTSEC-2023-0053 is patched >= 0.101.4;
  • RUSTSEC-2026-0049 is >= 0.103.10;
  • RUSTSEC-2026-0098 and -0099 are >= 0.103.12, < 0.104.0-alpha.1;
  • RUSTSEC-2026-0104 is >= 0.103.13, < 0.104.0-alpha.1.
• Releases.
  • v/0.103.14 adds stable ML-DSA support and marks ML-DSA as FIPS submitted (webpki#523, #525).
  • v/0.103.15 "Fixes docs.rs build errors" (#530, docs.rs features only).
  • Neither touches verification of the existing algorithms.

(6) CI at the head

Every check run is complete:

• success: Config, Rustfmt, Clippy, Test, Cargo Deny, CodeQL (python, ruby), dependency-review, StepSecurity Harden-Runner;
• skipped: the push-only release jobs (Build matrix, Sign & Notarize, Create Release, Attest, Update Homebrew Tap).

The combined status endpoint reads pending with total_count 0. That is GitHub's value when no commit status was ever posted, not a pending check.

Mechanics

• Commit. One commit, signed (%G? = U), parent develop 9fc9f69. The base is develop, which is right for gitflow.
• Scan. The body and the commit message have no dashes, host names, employer tokens, seat ids or 12-digit numbers (rc 1).
• Body wording. The body says cargo check --locked. The build and the tests also pass, which goes beyond what it claims.