deps: rustls 0.23.46 in the runtime; advisories checked in CI on every lockfile

.cargo/audit.toml

@@ -0,0 +1,37 @@
+# cargo-audit configuration. cargo-audit reads it from the current directory
+# only, so run scripts/audit.sh from anywhere: it audits every Cargo.lock in the
+# repo (the runtime and each connector) from the root, against this one list.
+
+[advisories]
+ignore = [
+    # rustls 0.22.4 and rustls-webpki 0.102.8 come with the sync `nats` 0.25
+    # client (core, connectors/amqp, connectors/mq); connectors/amqp also uses
+    # rustls 0.22 directly for amqps://. nats 0.25 is the last release of the
+    # sync client, so this line gets no patched version; moving to async-nats
+    # removes all six. Ignores go by advisory ID, so these would also hide
+    # 0346/0349 on rustls 0.23: keep core on >= 0.23.46.
+    # None is reachable the way the crates are used here:
+
+    # Debug output of client session values leaks secrets only through a
+    # custom ClientSessionStore; neither nats nor vejas-amqp installs one.
+    "RUSTSEC-2026-0346",
+    # An unauthenticated ServerHello can drop later connections from hybrid
+    # post-quantum to classical key exchange. rustls 0.22 on ring never offers
+    # a post-quantum group, so there is nothing to downgrade.
+    "RUSTSEC-2026-0349",
+    # CRL distribution-point matching and CRL parsing: no CRL is ever loaded.
+    "RUSTSEC-2026-0049",
+    "RUSTSEC-2026-0104",
+    # URI and wildcard name constraints: reachable only after signature
+    # verification, with a certificate misissued by a CA the client already
+    # trusts, and only on a TLS connection (a nats:// URL to a server that does
+    # not require TLS stays plaintext).
+    "RUSTSEC-2026-0098",
+    "RUSTSEC-2026-0099",
+
+    # idna 0.1.5 accepts Punycode labels that decode to plain ASCII. It comes
+    # through url 1.7 <- amq-protocol 1.4 <- amiquip 0.4.2 (the last amiquip
+    # release), in connectors/amqp only, where it parses the broker URL the
+    # operator configures, never untrusted input. Leaves with amiquip.
+    "RUSTSEC-2024-0421",
+]

.github/workflows/audit.yml

@@ -0,0 +1,21 @@
+name: audit
+
+# Every Cargo.lock in the repo against the RustSec advisory database. Daily as
+# well as on push: advisories are published without any commit here.
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: '23 5 * * *'
+  workflow_dispatch:
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Audit the runtime and every connector
+        run: scripts/audit.sh

CHANGELOG.md

@@ -13,6 +13,19 @@ is `0`, minor versions may carry breaking changes — they are called out here.
   `docker run IMAGE vejas-runtime --version` stayed up instead of answering.
   `e2e/detect` D3 checks it.
 
+### Security
+- **rustls 0.23.43 → 0.23.46** in the runtime, for RUSTSEC-2026-0285 (TLS 1.3
+  handshake messages accepted across encryption levels), -0346, -0348 and
+  -0349. rustls is the TLS stack of the runtime's HTTP client (http-poll,
+  oauth-poll, webhooks, Vault) and of MQTT over TLS.
+- **Dependency advisories are checked in CI.** `scripts/audit.sh` runs
+  cargo-audit on every `Cargo.lock` in the repo, the runtime and each
+  connector, on every push and once a day. Six advisories against rustls 0.22
+  and rustls-webpki 0.102 remain: they come with the sync `nats` 0.25 client,
+  which has no patched release, and moving to async-nats removes them.
+  `.cargo/audit.toml` lists them with the reason none is reachable here, as
+  well as idna 0.1.5 in the AMQP connector (via amiquip).
+
 ## [0.3.5] — 2026-09-24
 
 ### Changed — no cliff past ten thousand open correlations (varpulis #289)

scripts/audit.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Audit every Cargo.lock in the repo against the RustSec advisory database.
+#
+# The runtime (core/) and each connector crate carry their own lockfile, and
+# cargo-audit reads .cargo/audit.toml from the current directory only, so this
+# runs from the repo root with --file for each lock: one ignore list for all.
+# CI runs it on every push and once a day, since advisories land without any
+# commit here (.github/workflows/audit.yml).
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+fail=0
+while IFS= read -r lock; do
+  echo "[audit] $lock"
+  cargo audit --file "$lock" || fail=1
+done < <(git ls-files '*Cargo.lock')
+exit $fail