Repository navigation
fix: patch rustls TLS handshake boundary vulnerability - #1896
Merged
Merged
Conversation
Update only the locked rustls release from 0.23.43 to 0.23.45 for RUSTSEC-2026-0285. Preserve TLS providers, feature selection, and advisory policy. Refs #1895
inureyes
added
type:security
inureyes
added a commit
that referenced
this pull request
Sep 15, 2026
Closes #1846. Part of #1834. ## Changes - Add scoped browser/privacy, in-memory generation defaults, live settings and explicit next-load profiles using the published `@lablup/ui-common@0.1.0-alpha.19` adapters. No implicit credential or system-prompt persistence. - Preserve CLI/environment > profile > preset precedence, existing context/parallel/KV validation, operation identity and no hot worker mutation. Live edits detect observed fingerprint drift, retain rejected drafts and refetch effective values. - Fix shared authentication-session fencing, modal-unmount focus, field accessible names and base64url asset-hash caching; preserve feature-off compilation and exact browser assertions. ## Validation At source `8308a79f`, both workspace/all-target Clippy configurations, formatting, 47 contract fixtures/structural checks, both binary builds and both model-free entrypoints with relocated assets, network denial and TTY checks passed. Hosted run 34859248743 passed all executable checks; three jobs were skipped, not passed. The runtime/UI-equivalent `153d3c73` passed 119 frontend tests, 21 local/22 hosted browser cases, deterministic bundle verification and the serialized workspace suite (11,323 passed, zero failed, 361 ignored, plus two nested tests). A subsequent GPU recovery event has unknown root cause; the maintainer explicitly deferred that investigation to finish WebUI development. This is not a claimed firmware diagnosis or a waiver of actual feature failures. Actual Settings acceptance passed at `8308a79f`: Llama 2048/2/int8 and Granite 1024/1/fp16 reloads matched `/props` and generated responses; conflicting profiles respected all three CLI pins. Partial live PATCH/refetch, unchanged hot geometry and observed worker exit passed. Actual production-CSP browser checks at 1440/light and 390/dark passed with zero axe violations, no secret persistence and profile save without server mutation. Both temporary servers exited gracefully. Native Safari/VoiceOver and actual 200% zoom are deferred to the final integrated manual session. No CUDA runtime validation is claimed. Final security rebase `c8a78b7c` includes #1896. Both binaries were rebuilt; 47 contracts, the complete actual Settings acceptance above, and all executable hosted checks passed again.
15 of 21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
cargo deny --locked checkagainst refreshed advisory databasee2e640471715167f73e22eaf761f2e547adafeec; advisories, bans, licenses, and sources pass with existing warning-level notices.cargo tree --locked -i rustlsresolves only 0.23.45 across server TLS and HTTP clients;git diff --check.test-fast, selected CPU-only with no failures or ignored tests.Closes #1895