From 8734b0d3d5d8dd9367b76b2fe12043bf970a28ed Mon Sep 17 00:00:00 2001
From: Zyy <39424122+zyycn@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:59:59 +0800
Subject: [PATCH] fix(openai): keep fingerprint-pinned TLS versions (#35)

Co-authored-by: Zyy <zyycn@users.noreply.github.com>
---
 backend/Cargo.lock                         | 9 +++++----
 backend/crates/providers/openai/Cargo.toml | 4 ++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index add45b43b..c965814c3 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -1897,9 +1897,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.9"
+version = "0.27.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
 dependencies = [
  "http 1.4.2",
  "hyper",
@@ -1907,6 +1907,7 @@ dependencies = [
  "log",
  "rustls",
  "rustls-native-certs",
+ "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -3008,9 +3009,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.43"
+version = "0.23.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
 dependencies = [
  "aws-lc-rs",
  "log",
diff --git a/backend/crates/providers/openai/Cargo.toml b/backend/crates/providers/openai/Cargo.toml
index 236b90e2e..2aae438d8 100644
--- a/backend/crates/providers/openai/Cargo.toml
+++ b/backend/crates/providers/openai/Cargo.toml
@@ -26,7 +26,7 @@ hex = "0.4.3"
 # ChatGPT.app Resources/codex 二进制内为 hyper-rustls 0.27.7 + rustls 0.23.36 +
 # reqwest 0.12.28 + ring）。rustls 0.23.37 起 ClientHello 扩展顺序变化，JA3
 # 会偏离官方指纹；升级前必须重新抓握手对比扩展顺序。
-hyper-rustls = "=0.27.9"
+hyper-rustls = "=0.27.7"
 jsonwebtoken = { version = "=11.0.0", default-features = false, features = ["aws_lc_rs", "use_pem"] }
 # 与官方 Codex Desktop 一致：reqwest 不启用压缩特性，上游请求不带 accept-encoding。
 reqwest = { version = "=0.12.28", default-features = false, features = ["json", "stream", "cookies", "rustls-tls-native-roots", "http2"] }
@@ -34,7 +34,7 @@ roxmltree = "0.21.1"
 semver = "1.0.27"
 # 保持 ring provider：reqwest rustls-tls-native-roots 即 __rustls-ring，与官方一致；
 # 不要给 TLS 客户端路径启用 aws_lc_rs，否则密钥共享/扩展集可能变化。
-rustls = { version = "=0.23.43", default-features = false, features = ["ring", "std", "tls12"] }
+rustls = { version = "=0.23.36", default-features = false, features = ["ring", "std", "tls12"] }
 rustls-native-certs = "0.8.4"
 rustls-pki-types = "1.14.1"
 secrecy = "0.10.3"