From 260f7750393b0ef692eb091a8b7c0a1bf67a9aef Mon Sep 17 00:00:00 2001
From: Zyy <zyycn@users.noreply.github.com>
Date: Wed, 14 Oct 2026 22:41:06 +0800
Subject: [PATCH] fix(deps): patch rustls vulnerabilities after TLS fingerprint
 verification

Pin rustls to 0.23.46 while retaining the TLS features and Dependabot
ignore policy. Preserve the sampled Codex HTTP and WebSocket handshake
characteristics and document the manual security-patch policy.

Validation: Cargo audit, strict workspace Clippy, TLS and proxy transport
tests, and real-account HTTP and WebSocket handshakes.

Co-authored-by: Codex <noreply@openai.com>
---
 backend/Cargo.lock                         | 4 ++--
 backend/crates/gateway-host/Cargo.toml     | 2 +-
 backend/crates/providers/openai/Cargo.toml | 5 +++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d21307ad7..7dc9fdbc9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -3779,9 +3779,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "log",
diff --git a/backend/crates/gateway-host/Cargo.toml b/backend/crates/gateway-host/Cargo.toml
index 4fa36d20b..11372670d 100644
--- a/backend/crates/gateway-host/Cargo.toml
+++ b/backend/crates/gateway-host/Cargo.toml
@@ -27,7 +27,7 @@ hyper-util = { version = "0.1.20", features = ["client-legacy", "client-proxy",
 ipnet = "2.11.0"
 percent-encoding = "2.3.2"
 reqwest = { version = "=0.12.28", default-features = false, features = ["json", "stream", "rustls-tls-native-roots", "socks"] }
-rustls = { version = "=0.23.45", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
+rustls = { version = "=0.23.46", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
 rustls-native-certs = "=0.8.3"
 scraper = "0.27.0"
 semver = "1.0.27"
diff --git a/backend/crates/providers/openai/Cargo.toml b/backend/crates/providers/openai/Cargo.toml
index 1b3ba137e..09c4b26e0 100644
--- a/backend/crates/providers/openai/Cargo.toml
+++ b/backend/crates/providers/openai/Cargo.toml
@@ -23,7 +23,8 @@ gateway-core = { path = "../../gateway-core" }
 gateway-protocol = { path = "../../gateway-protocol" }
 getrandom = "0.4.3"
 hex = "0.4.3"
-# TLS 依赖按官方 Core 锁文件固定，包含用于约束传递依赖的直接声明。
+# TLS 依赖以官方 Core 锁文件为基线，安全补丁经握手特征核验后精确固定
+# 包含用于约束传递依赖的直接声明
 # hyper 受 workspace 的 SOCKS IPv6 修复补丁约束，保留补丁要求的兼容版本。
 # 升级前须重复采样 ClientHello，核对算法、扩展集合及排序约束、key_share 与 ALPN。
 aws-lc-rs = "=1.18.1"
@@ -40,7 +41,7 @@ roxmltree = "0.21.1"
 semver = "1.0.27"
 # 与官方 rustls 路径一致：aws-lc 支持 P-521，优先提供 X25519MLKEM768。
 # reqwest 的 roots feature 仍会编译 ring；实际 provider 由 TLS 初始化显式选择。
-rustls = { version = "=0.23.45", default-features = false, features = ["aws_lc_rs", "prefer-post-quantum", "std", "tls12"] }
+rustls = { version = "=0.23.46", default-features = false, features = ["aws_lc_rs", "prefer-post-quantum", "std", "tls12"] }
 rustls-native-certs = "=0.8.3"
 rustls-pki-types = "=1.14.0"
 secrecy = "0.10.3"