[c3ru]

Moves rustls to 0.23.46 to fix 3 open Dependabot alerts (highest: medium). Alerts

package	from → to	severity	advisory
rustls	< 0.23.46 → 0.23.46	medium	GHSA-c8m5-c952-6cm4
rustls	< 0.23.46 → 0.23.46	low	GHSA-w44r-93j7-qv28
rustls	< 0.23.46 → 0.23.46	low	GHSA-h2v8-394m-p7vv

Why this change

rustls is a transitive dependency (via jsonrpsee and 6 other crates), so only Cargo.lock changes; Cargo.toml does not list it.

How it was checked

• Installed the dependencies, then ran the test suite, lint and the build on this PR and on the base branch, on a clean Mac: no new failures. (CI checks were flaky)
• Every alert's package is at or above its patched version in the lockfile.
• CI on this PR: see the checks below. The PR merges only when they are green or fail on the base branch too.

What you need to do

Review and approve. Once approved and green, the PR is merged for you.

Verification log

$ cargo vet --locked → exit 0
$ cargo fetch --locked → exit 0
$ cargo build --locked --features rdkafka/ssl-vendored → exit 0
$ mise exec rust@nightly-2026-05-08 -- cargo fmt --all --check → exit 0
$ mise exec rust@nightly-2026-05-08 -- cargo clippy --workspace --all-targets --locked --features rdkafka/ssl-vendored -- -D warnings -A clippy::unwrap_used -A clippy::expect_used -A clippy::panic → exit 0
$ ulimit -n 4096 && cargo test --workspace --locked --features rdkafka/ssl-vendored --quiet → exit 0
$ test "$(cargo tree -i rustls --locked | sed -n '1p')" = 'rustls v0.23.46' → exit 0
$ git diff --check → exit 0
rustls GHSA-w44r-93j7-qv28: found [0.23.46] need >= 0.23.46
rustls GHSA-h2v8-394m-p7vv: found [0.23.46] need >= 0.23.46
rustls GHSA-c8m5-c952-6cm4: found [0.23.46] need >= 0.23.46

Tracked in cloudwalk/dependabot-factory#1804.

[cloudwalk-review-agent]

Summary

The lockfile updates rustls from 0.23.31 to 0.23.46 and its registry checksum, with no other dependency graph changes in the diff. This is a focused dependency update addressing the listed advisories; no issues found.

[cloudwalk-review-agent]

Summary

The lockfile updates rustls to 0.23.46 with its matching checksum, and the cargo-vet exemption is updated to the same version. This is a focused dependency update; no issues found.