{"uuid": "d76885c0-f396-46f8-a98f-4164671b1c1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2mjx-qc3c-rqvc", "type": "seen", "source": "https://gist.github.com/citadelculture/7a82e9f9aea119e1eacf3eb5399678eb", "content": "# CorbanuTerminal: RUSTSEC-2026-0285 dependency and remediation audit\n\n**Decision:** update the lockfile with a targeted Rustls 0.23.45 resolution. No Cargo.toml or intermediate-library version change is needed. The tested dry run also updates aws-lc-rs, aws-lc-sys and rustls-webpki; \u201ctarget Rustls alone\u201d does not mean manually editing one lockfile entry. This is a read-only investigation, not an applied fix or passing CI claim.\n\nTasknode task: `task_d998ec772979690a6bb6b9ad844e39fd`. Inspected 26 September 2026; exact Corbanu main pin `c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b`. All evidence below comes from public source, public CI, published crate manifests and non-mutating local Cargo commands. No repository files changed, no PR was opened and nothing was pushed for this task.\n\n## 1. Literal failure and exact source pin\n\nInspected current main `c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b` on 26 September 2026. The latest failed main `blocking-ci` run is [35788214243](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243), created 22 September 2026 at 21:42:15 UTC. Its failed [cargo-deny / cargo-deny job 106959375931](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959375931) has that exact head.\n\nLiteral diagnostic text follows. Only ANSI color escapes and GitHub's timestamp prefixes were removed; diagnostic text and indentation were preserved.\n\n```text\nerror[vulnerability]: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries\n    \u250c\u2500 /github/workspace/codex-rs/Cargo.lock:872:1\n    \u2502\n872 \u2502 rustls 0.23.36 registry+https://github.com/rust-lang/crates.io-index\n    \u2502 \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 security vulnerability detected\n    \u2502\n    \u251c ID: RUSTSEC-2026-0285\n    \u251c Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0285\n```\n\nThe quoted Cargo.lock line number belongs to cargo-deny's diagnostic representation; use the pinned repository links below for actual source locations. This is a rustls advisory failure. The separate reqwest 0.12.28 ban in the same job is out of scope and would not be repaired by the rustls update. No green whole-job result is claimed.\n\n## 2. Complete dependency paths and version rules\n\nRead-only source pin: [`c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b`](https://github.com/CorbanuCore/CorbanuTerminal/commit/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b). The source of resolved versions and edges is the pinned [`codex-rs/Cargo.lock`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/Cargo.lock), SHA-256 `ef3d5d1d0e4964f2949b4d1ecf1e172af66ae18d6bec090e3a626cefbb6485a2`. The manifest defaults come from [`codex-rs/Cargo.toml`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/Cargo.toml). No code or manifest changes, builds, tests, pull requests or pushes were made for this audit.\n\nThis lockfile contains one Rustls version, **0.23.36**, and **14 immediate incoming package edges**, not just the two intermediaries named in the brief. In particular, Rustls is also declared directly by four workspace crates, including an exec-server development dependency. All 14 immediate version constraints admit **0.23.45**. No change to the pinned hyper-rustls 0.27.7 or rama-tls-rustls 0.3.0-alpha.4 is required for that Rustls update to resolve.\n\n### All immediate Rustls declarations\n\nA plain Cargo version such as `0.23.27` means the caret range `>=0.23.27, <0.24.0`; `0.23` means `>=0.23.0, <0.24.0`. `workspace = true` inherits the root [`[workspace.dependencies].rustls` declaration, lines 432\u2013435](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/Cargo.toml#L432): `version = \"0.23\"`, `default-features = false`, features `aws_lc_rs` and `std`. Optional/target-specific entries below are locked graph edges, not a claim that every feature is active in every build.\n\n| Parent (resolved version) | Exact Cargo.toml source | Rustls version rule / scope |\n| --- | --- | --- |\n| `aws-smithy-http-client@1.1.12` | [Cargo.toml](https://docs.rs/crate/aws-smithy-http-client/1.1.12/source/Cargo.toml) | `0.23.31 (caret)`; `dependencies.rustls`; optional; defaults off |\n| `codex-exec-server@0.1.42` | [Cargo.toml](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/exec-server/Cargo.toml) | `workspace = true \u2192 ^0.23`; `dev-dependencies.rustls` |\n| `codex-http-client@0.1.42` | [Cargo.toml](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/http-client/Cargo.toml) | `workspace = true \u2192 ^0.23`; `dependencies.rustls` |\n| `codex-utils-rustls-provider@0.1.42` | [Cargo.toml](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/utils/rustls-provider/Cargo.toml) | `workspace = true \u2192 ^0.23`; `dependencies.rustls` |\n| `codex-websocket-client@0.1.42` | [Cargo.toml](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/websocket-client/Cargo.toml) | `workspace = true \u2192 ^0.23`; `dependencies.rustls` |\n| `hyper-rustls@0.27.7` | [Cargo.toml](https://docs.rs/crate/hyper-rustls/0.27.7/source/Cargo.toml) | `0.23 (caret)`; `dependencies.rustls`; defaults off |\n| `quinn-proto@0.11.14` | [Cargo.toml](https://docs.rs/crate/quinn-proto/0.11.14/source/Cargo.toml) | `0.23.5 (caret)`; `dependencies.rustls`; optional; features: std; defaults off |\n| `quinn@0.11.9` | [Cargo.toml](https://docs.rs/crate/quinn/0.11.9/source/Cargo.toml) | `0.23.5 (caret)`; `dependencies.rustls`; optional; features: std; defaults off |\n| `rama-tls-rustls@0.3.0-alpha.4` | [Cargo.toml](https://docs.rs/crate/rama-tls-rustls/0.3.0-alpha.4/source/Cargo.toml) | `0.23 (caret)`; `dependencies.rustls`; features: logging, std, tls12, aws_lc_rs; defaults off |\n| `reqwest@0.12.28` | [Cargo.toml](https://docs.rs/crate/reqwest/0.12.28/source/Cargo.toml) | `0.23.4 (caret)`; `target.cfg(not(target_arch = \"wasm32\")).dependencies.rustls`; optional; features: std, tls12; defaults off |\n| `sqlx-core@0.9.0` | [Cargo.toml](https://docs.rs/crate/sqlx-core/0.9.0/source/Cargo.toml) | `0.23.24 (caret)`; `dependencies.rustls`; optional; features: std, tls12; defaults off |\n| `tokio-rustls@0.26.4` | [Cargo.toml](https://docs.rs/crate/tokio-rustls/0.26.4/source/Cargo.toml) | `0.23.27 (caret)`; `dependencies.rustls`; features: std; defaults off |\n| `tokio-tungstenite@0.28.0` | [Cargo.toml](https://github.com/openai-oss-forks/tokio-tungstenite/blob/0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186/Cargo.toml) | `0.23.0 (caret)`; `dependencies.rustls`; optional; defaults off |\n| `tungstenite@0.27.0` | [Cargo.toml](https://github.com/openai-oss-forks/tungstenite-rs/blob/4fffad30fe373adbdcffab9545e9e9bf4f2fc19f/Cargo.toml) | `0.23.0 (caret)`; `dependencies.rustls`; optional; features: std; defaults off |\n\nThe two WebSocket dependencies are **Git-patched sources**, not the same-number registry releases: [`tokio-tungstenite` at `0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/Cargo.toml#L644) and [`tungstenite-rs` at `4fffad30fe373adbdcffab9545e9e9bf4f2fc19f`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/Cargo.toml#L645). Their inspected manifests both declare optional Rustls `version = \"0.23.0\"`. The normalized published registry manifests above were checked against archives whose SHA-256 matches the exact pinned Cargo.lock checksum; their package-level development dependencies are deliberately excluded from the consumed graph.\n\n### Where workspace manifests enter the external TLS dependency graph\n\nThese are all **60 declaration records** in workspace manifests that enter any external package on the locked path to Rustls. Repeated names in one file are separate normal/development declarations. The \u201crequirement\u201d column is Cargo metadata's resolved requirement, including inherited workspace definitions; it is not the exact pinned lockfile version. All rename fields equal the package names here, so no renamed workspace entry is omitted. `normal` means the normal dependency table, not a claim all transitive optional features are enabled. The complete table of resolved versions and onward edges follows below.\n\n| Workspace manifest / line | Package | Requirement | Declaration scope |\n| --- | --- | --- | --- |\n| [`codex-rs/app-server-client/Cargo.toml:32`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-client/Cargo.toml#L32) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/app-server-daemon/Cargo.toml:36`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-daemon/Cargo.toml#L36) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/app-server-protocol/Cargo.toml:29`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-protocol/Cargo.toml#L29) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/app-server-protocol/Cargo.toml:43`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-protocol/Cargo.toml#L43) | `rmcp` | `=3.0.0` | dev |\n| [`codex-rs/app-server-test-client/Cargo.toml:23`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-test-client/Cargo.toml#L23) | `tungstenite` | `^0.27.0` | normal |\n| [`codex-rs/app-server-transport/Cargo.toml:17`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-transport/Cargo.toml#L17) | `axum` | `^0.8` | normal |\n| [`codex-rs/app-server-transport/Cargo.toml:51`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server-transport/Cargo.toml#L51) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/app-server/Cargo.toml:30`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server/Cargo.toml#L30) | `axum` | `^0.8` | normal |\n| [`codex-rs/app-server/Cargo.toml:117`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server/Cargo.toml#L117) | `axum` | `^0.8` | dev |\n| [`codex-rs/app-server/Cargo.toml:131`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server/Cargo.toml#L131) | `reqwest` | `^0.12` | dev |\n| [`codex-rs/app-server/Cargo.toml:132`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server/Cargo.toml#L132) | `rmcp` | `=3.0.0` | dev |\n| [`codex-rs/app-server/Cargo.toml:142`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/app-server/Cargo.toml#L142) | `tokio-tungstenite` | `^0.28.0` | dev |\n| [`codex-rs/aws-auth/Cargo.toml:16`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/aws-auth/Cargo.toml#L16) | `aws-config` | `^1` | normal |\n| [`codex-rs/browser-isolation/Cargo.toml:19`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/browser-isolation/Cargo.toml#L19) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/cli/Cargo.toml:113`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/cli/Cargo.toml#L113) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/cli/Cargo.toml:153`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/cli/Cargo.toml#L153) | `sqlx` | `^0.9.0` | dev |\n| [`codex-rs/cli/Cargo.toml:154`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/cli/Cargo.toml#L154) | `tokio-tungstenite` | `^0.28.0` | dev |\n| [`codex-rs/code-mode-host/Cargo.toml:21`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/code-mode-host/Cargo.toml#L21) | `axum` | `^0.8` | normal |\n| [`codex-rs/code-mode-host/Cargo.toml:38`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/code-mode-host/Cargo.toml#L38) | `tokio-tungstenite` | `^0.28.0` | dev |\n| [`codex-rs/code-mode/Cargo.toml:22`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/code-mode/Cargo.toml#L22) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/codex-api/Cargo.toml:24`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/codex-api/Cargo.toml#L24) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/codex-api/Cargo.toml:25`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/codex-api/Cargo.toml#L25) | `tungstenite` | `^0.27.0` | normal |\n| [`codex-rs/codex-mcp/Cargo.toml:34`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/codex-mcp/Cargo.toml#L34) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/codex-mcp/Cargo.toml:48`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/codex-mcp/Cargo.toml#L48) | `rmcp` | `=3.0.0` | dev |\n| [`codex-rs/config/Cargo.toml:45`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/config/Cargo.toml#L45) | `tonic` | `^0.14.3` | normal |\n| [`codex-rs/config/Cargo.toml:46`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/config/Cargo.toml#L46) | `tonic-prost` | `^0.14.3` | normal |\n| [`codex-rs/config/Cargo.toml:70`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/config/Cargo.toml#L70) | `tonic` | `^0.14.3` | dev |\n| [`codex-rs/core/Cargo.toml:102`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/core/Cargo.toml#L102) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/core/Cargo.toml:125`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/core/Cargo.toml#L125) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/core/tests/common/Cargo.toml:43`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/core/tests/common/Cargo.toml#L43) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/exec-server/Cargo.toml:15`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/exec-server/Cargo.toml#L15) | `axum` | `^0.8` | normal |\n| [`codex-rs/exec-server/Cargo.toml:51`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/exec-server/Cargo.toml#L51) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/exec-server/Cargo.toml:75`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/exec-server/Cargo.toml#L75) | `rustls` | `^0.23` | dev |\n| [`codex-rs/feedback/Cargo.toml:15`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/feedback/Cargo.toml#L15) | `sentry` | `^0.46` | normal |\n| [`codex-rs/gpu-market/Cargo.toml:17`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/gpu-market/Cargo.toml#L17) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/http-client/Cargo.toml:13`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/http-client/Cargo.toml#L13) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/http-client/Cargo.toml:14`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/http-client/Cargo.toml#L14) | `rustls` | `^0.23` | normal |\n| [`codex-rs/mcp-server/Cargo.toml:33`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/mcp-server/Cargo.toml#L33) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/mcp-server/tests/common/Cargo.toml:21`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/mcp-server/tests/common/Cargo.toml#L21) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/network-proxy/Cargo.toml:40`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/network-proxy/Cargo.toml#L40) | `rama-tls-rustls` | `=0.3.0-alpha.4` | normal |\n| [`codex-rs/otel/Cargo.toml:25`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/otel/Cargo.toml#L25) | `opentelemetry-otlp` | `^0.31.0` | normal |\n| [`codex-rs/otel/Cargo.toml:49`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/otel/Cargo.toml#L49) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/otel/Cargo.toml:55`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/otel/Cargo.toml#L55) | `tokio-tungstenite` | `^0.28.0` | normal |\n| [`codex-rs/responses-api-proxy/Cargo.toml:25`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/responses-api-proxy/Cargo.toml#L25) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/rmcp-client/Cargo.toml:12`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/rmcp-client/Cargo.toml#L12) | `axum` | `^0.8` | normal |\n| [`codex-rs/rmcp-client/Cargo.toml:33`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/rmcp-client/Cargo.toml#L33) | `oauth2` | `^5` | normal |\n| [`codex-rs/rmcp-client/Cargo.toml:34`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/rmcp-client/Cargo.toml#L34) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/state/Cargo.toml:16`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/state/Cargo.toml#L16) | `sqlx` | `^0.9.0` | normal |\n| [`codex-rs/tasknode-session/Cargo.toml:26`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/tasknode-session/Cargo.toml#L26) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/telegram/Cargo.toml:41`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/telegram/Cargo.toml#L41) | `teloxide` | `^0.17` | normal |\n| [`codex-rs/thread-store/Cargo.toml:30`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/thread-store/Cargo.toml#L30) | `sqlx` | `^0.9.0` | normal |\n| [`codex-rs/tools/Cargo.toml:22`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/tools/Cargo.toml#L22) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/tui/Cargo.toml:97`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/tui/Cargo.toml#L97) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/tui/Cargo.toml:98`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/tui/Cargo.toml#L98) | `rmcp` | `=3.0.0` | normal |\n| [`codex-rs/tui/Cargo.toml:173`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/tui/Cargo.toml#L173) | `tokio-tungstenite` | `^0.28.0` | dev |\n| [`codex-rs/utils/rustls-provider/Cargo.toml:11`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/utils/rustls-provider/Cargo.toml#L11) | `rustls` | `^0.23` | normal |\n| [`codex-rs/wallet/Cargo.toml:24`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/wallet/Cargo.toml#L24) | `reqwest` | `^0.12` | normal |\n| [`codex-rs/websocket-client/Cargo.toml:10`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/websocket-client/Cargo.toml#L10) | `rustls` | `^0.23` | normal |\n| [`codex-rs/websocket-client/Cargo.toml:12`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/websocket-client/Cargo.toml#L12) | `tokio-rustls` | `^0.26.4` | normal |\n| [`codex-rs/websocket-client/Cargo.toml:13`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/websocket-client/Cargo.toml#L13) | `tokio-tungstenite` | `^0.28.0` | normal |\n\n\nComplete factorized lockfile paths: 145 nodes, 792 edges, 110 workspace roots\n\nThis is the entire ancestor subgraph of `rustls@0.23.36`, extracted from every package/dependency record in the pinned lockfile and matched with `cargo metadata --no-deps --locked --offline`. It has **145 package nodes**, **792 dependency edges**, and **110 workspace-root nodes**. An edge points **from dependent to dependency**. To recover a full chain, start at any row with a workspace manifest and repeatedly follow its listed dependency IDs until the Rustls row. Every edge on every such locked chain is shown; there are no omitted `(*)` subtrees or implicit aliases. Development dependencies can introduce cycles, so this is a directed graph, not necessarily a DAG; only simple paths are needed to trace inclusion. All workspace versions are explicitly shown as 0.1.42. A `registry` source means the crates.io package of that exact name/version; Git sources are labeled at their exact commits above.\n\nEvery relative manifest below refers to the **same pinned repository URL** given at the beginning, not a local filesystem location. \u201cRegistry\u201d rows are transitive external packages; they have no workspace Cargo.toml. This graph describes actual locked versions, while the preceding tables describe version requirements.\n\n| ID | Package / resolved version | Workspace manifest or source | Direct dependency IDs on paths to Rustls |\n| --- | --- | --- | --- |\n| N001 | `app_test_support@0.1.42` | `codex-rs/app-server/tests/common/Cargo.toml` | N018, N038, N045, N048, N052, N066, N076, N083, N118 |\n| N002 | `aws-config@1.8.12` | registry | N003, N004, N005, N006, N007, N009 |\n| N003 | `aws-runtime@1.5.17` | registry | N009 |\n| N004 | `aws-sdk-signin@1.2.0` | registry | N003, N009 |\n| N005 | `aws-sdk-sso@1.91.0` | registry | N003, N009 |\n| N006 | `aws-sdk-ssooidc@1.93.0` | registry | N003, N009 |\n| N007 | `aws-sdk-sts@1.95.0` | registry | N003, N009 |\n| N008 | `aws-smithy-http-client@1.1.12` | registry | N119, N130, N141 |\n| N009 | `aws-smithy-runtime@1.9.5` | registry | N008 |\n| N010 | `axum@0.8.8` | registry | N142 |\n| N011 | `codex-agent-extension@0.1.42` | `codex-rs/ext/agent/Cargo.toml` | N045, N083, N118 |\n| N012 | `codex-agent-graph-store@0.1.42` | `codex-rs/agent-graph-store/Cargo.toml` | N083, N097 |\n| N013 | `codex-agent-identity@0.1.42` | `codex-rs/agent-identity/Cargo.toml` | N062, N083 |\n| N014 | `codex-analytics@0.1.42` | `codex-rs/analytics/Cargo.toml` | N018, N056, N066, N075, N080, N083, N097 |\n| N015 | `codex-api@0.1.42` | `codex-rs/codex-api/Cargo.toml` | N029, N062, N083, N110, N116, N142, N145 |\n| N016 | `codex-app-server-client@0.1.42` | `codex-rs/app-server-client/Cargo.toml` | N018, N021, N023, N038, N045, N048, N053, N074, N083, N084, N110, N142 |\n| N017 | `codex-app-server-daemon@0.1.42` | `codex-rs/app-server-daemon/Cargo.toml` | N018, N020, N062, N142 |\n| N018 | `codex-app-server-protocol@0.1.42` | `codex-rs/app-server-protocol/Cargo.toml` | N083, N093, N129 |\n| N019 | `codex-app-server-test-client@0.1.42` | `codex-rs/app-server-test-client/Cargo.toml` | N018, N045, N079, N083, N106, N145 |\n| N020 | `codex-app-server-transport@0.1.42` | `codex-rs/app-server-transport/Cargo.toml` | N010, N015, N018, N038, N045, N066, N075, N083, N097, N110, N142 |\n| N021 | `codex-app-server@0.1.42` | `codex-rs/app-server/Cargo.toml` | N001, N010, N011, N014, N018, N020, N023, N025, N027, N030, N037, N038, N040, N043, N045, N048, N050, N051, N052, N053, N055, N056, N057, N059, N060, N061, N062, N063, N066, N067, N069, N070, N072, N074, N075, N076, N079, N080, N083, N087, N089, N090, N093, N095, N096, N097, N102, N103, N106, N115, N117, N118, N128, N129, N142 |\n| N022 | `codex-apply-patch@0.1.42` | `codex-rs/apply-patch/Cargo.toml` | N048 |\n| N023 | `codex-arg0@0.1.42` | `codex-rs/arg0/Cargo.toml` | N022, N048, N064, N090, N094, N117 |\n| N024 | `codex-aws-auth@0.1.42` | `codex-rs/aws-auth/Cargo.toml` | N002 |\n| N025 | `codex-backend-client@0.1.42` | `codex-rs/backend-client/Cargo.toml` | N015, N062, N066, N075, N083 |\n| N026 | `codex-browser-isolation@0.1.42` | `codex-rs/browser-isolation/Cargo.toml` | N077, N128 |\n| N027 | `codex-chatgpt@0.1.42` | `codex-rs/chatgpt/Cargo.toml` | N040, N045, N056, N066, N075, N080, N106 |\n| N028 | `codex-cli@0.1.42` | `codex-rs/cli/Cargo.toml` | N001, N015, N017, N018, N019, N021, N023, N027, N030, N033, N038, N043, N045, N048, N049, N050, N052, N055, N056, N058, N060, N062, N066, N068, N069, N072, N075, N076, N080, N083, N086, N087, N088, N089, N090, N097, N098, N099, N104, N106, N112, N117, N128, N138, N142 |\n| N029 | `codex-client@0.1.42` | `codex-rs/codex-client/Cargo.toml` | N062 |\n| N030 | `codex-cloud-config@0.1.42` | `codex-rs/cloud-config/Cargo.toml` | N013, N025, N038, N045, N062, N066, N079, N083 |\n| N031 | `codex-cloud-tasks-client@0.1.42` | `codex-rs/cloud-tasks-client/Cargo.toml` | N015, N025, N056, N062 |\n| N032 | `codex-cloud-tasks-mock-client@0.1.42` | `codex-rs/cloud-tasks-mock-client/Cargo.toml` | N031 |\n| N033 | `codex-cloud-tasks@0.1.42` | `codex-rs/cloud-tasks/Cargo.toml` | N031, N032, N045, N056, N062, N066, N075, N104, N106 |\n| N034 | `codex-code-mode-host@0.1.42` | `codex-rs/code-mode-host/Cargo.toml` | N010, N035, N036, N037, N083, N142 |\n| N035 | `codex-code-mode-protocol@0.1.42` | `codex-rs/code-mode-protocol/Cargo.toml` | N083 |\n| N036 | `codex-code-mode-runtime@0.1.42` | `codex-rs/code-mode-runtime/Cargo.toml` | N035, N083 |\n| N037 | `codex-code-mode@0.1.42` | `codex-rs/code-mode/Cargo.toml` | N035, N062, N083, N116, N142 |\n| N038 | `codex-config@0.1.42` | `codex-rs/config/Cargo.toml` | N052, N054, N056, N074, N077, N083, N143, N144 |\n| N039 | `codex-connectors-extension@0.1.42` | `codex-rs/ext/connectors/Cargo.toml` | N040, N043, N080 |\n| N040 | `codex-connectors@0.1.42` | `codex-rs/connectors/Cargo.toml` | N038, N066, N079, N080, N083 |\n| N041 | `codex-context-fragments@0.1.42` | `codex-rs/context-fragments/Cargo.toml` | N083 |\n| N042 | `codex-core-api@0.1.42` | `codex-rs/core-api/Cargo.toml` | N014, N018, N023, N038, N045, N048, N050, N052, N060, N063, N066, N074, N076, N083, N097 |\n| N043 | `codex-core-plugins@0.1.42` | `codex-rs/core-plugins/Cargo.toml` | N014, N018, N038, N040, N044, N047, N048, N056, N061, N062, N066, N069, N075, N079, N080, N083, N093, N096, N103, N109 |\n| N044 | `codex-core-skills@0.1.42` | `codex-rs/core-skills/Cargo.toml` | N014, N038, N041, N048, N066, N075, N079, N083, N093, N096, N108, N109 |\n| N045 | `codex-core@0.1.42` | `codex-rs/core/Cargo.toml` | N012, N014, N015, N018, N022, N026, N037, N038, N040, N041, N043, N044, N047, N048, N050, N052, N053, N054, N056, N060, N061, N062, N063, N066, N069, N071, N074, N075, N076, N077, N079, N080, N081, N082, N083, N085, N087, N088, N089, N090, N093, N094, N095, N096, N097, N100, N102, N103, N108, N109, N112, N115, N117, N118, N129, N142 |\n| N046 | `codex-exec-server-protocol@0.1.42` | `codex-rs/exec-server-protocol/Cargo.toml` | N054, N077, N083, N093 |\n| N047 | `codex-exec-server-test-support@0.1.42` | `codex-rs/exec-server/tests/support/Cargo.toml` | N048, N062 |\n| N048 | `codex-exec-server@0.1.42` | `codex-rs/exec-server/Cargo.toml` | N010, N015, N046, N047, N054, N062, N077, N079, N083, N090, N100, N110, N116, N130, N142 |\n| N049 | `codex-exec@0.1.42` | `codex-rs/exec/Cargo.toml` | N016, N018, N022, N023, N030, N038, N045, N053, N056, N066, N074, N079, N083, N106, N107, N111, N118 |\n| N050 | `codex-extension-api@0.1.42` | `codex-rs/ext/extension-api/Cargo.toml` | N038, N041, N046, N069, N083, N103 |\n| N051 | `codex-external-agent-migration@0.1.42` | `codex-rs/external-agent-migration/Cargo.toml` | N014, N018, N038, N043, N045, N061, N072, N079, N080, N083, N089, N108 |\n| N052 | `codex-features@0.1.42` | `codex-rs/features/Cargo.toml` | N079, N083 |\n| N053 | `codex-feedback@0.1.42` | `codex-rs/feedback/Cargo.toml` | N066, N083, N131 |\n| N054 | `codex-file-system@0.1.42` | `codex-rs/file-system/Cargo.toml` | N083 |\n| N055 | `codex-git-attribution@0.1.42` | `codex-rs/ext/git-attribution/Cargo.toml` | N025, N050, N062, N066 |\n| N056 | `codex-git-utils@0.1.42` | `codex-rs/git-utils/Cargo.toml` | N054, N083 |\n| N057 | `codex-goal-extension@0.1.42` | `codex-rs/ext/goal/Cargo.toml` | N014, N045, N050, N079, N083, N097, N103 |\n| N058 | `codex-gpu-market@0.1.42` | `codex-rs/gpu-market/Cargo.toml` | N097, N112, N128 |\n| N059 | `codex-guardian@0.1.42` | `codex-rs/ext/guardian/Cargo.toml` | N045, N050, N083 |\n| N060 | `codex-home@0.1.42` | `codex-rs/codex-home/Cargo.toml` | N050 |\n| N061 | `codex-hooks@0.1.42` | `codex-rs/hooks/Cargo.toml` | N038, N080, N083, N108 |\n| N062 | `codex-http-client@0.1.42` | `codex-rs/http-client/Cargo.toml` | N110, N128, N130 |\n| N063 | `codex-image-generation-extension@0.1.42` | `codex-rs/ext/image-generation/Cargo.toml` | N015, N045, N048, N050, N066, N074, N075, N083, N103 |\n| N064 | `codex-linux-sandbox@0.1.42` | `codex-rs/linux-sandbox/Cargo.toml` | N045, N077, N083, N090 |\n| N065 | `codex-lmstudio@0.1.42` | `codex-rs/lmstudio/Cargo.toml` | N045, N062, N074 |\n| N066 | `codex-login@0.1.42` | `codex-rs/login/Cargo.toml` | N013, N038, N062, N074, N079, N083, N092, N112, N118 |\n| N067 | `codex-mcp-extension@0.1.42` | `codex-rs/ext/mcp/Cargo.toml` | N038, N039, N040, N043, N045, N048, N050, N052, N066, N069, N080, N083 |\n| N068 | `codex-mcp-server@0.1.42` | `codex-rs/mcp-server/Cargo.toml` | N001, N023, N038, N045, N048, N050, N055, N060, N063, N066, N083, N093, N106, N118, N120, N129 |\n| N069 | `codex-mcp@0.1.42` | `codex-rs/codex-mcp/Cargo.toml` | N015, N038, N040, N047, N048, N066, N075, N079, N080, N083, N087, N109, N129 |\n| N070 | `codex-memories-extension@0.1.42` | `codex-rs/ext/memories/Cargo.toml` | N045, N050, N052, N079, N103, N108 |\n| N071 | `codex-memories-read@0.1.42` | `codex-rs/memories/read/Cargo.toml` | N083, N093 |\n| N072 | `codex-memories-write@0.1.42` | `codex-rs/memories/write/Cargo.toml` | N025, N038, N045, N052, N056, N066, N074, N075, N076, N079, N083, N088, N089, N092, N097, N108, N118 |\n| N073 | `codex-message-history@0.1.42` | `codex-rs/message-history/Cargo.toml` | N038 |\n| N074 | `codex-model-provider-info@0.1.42` | `codex-rs/model-provider-info/Cargo.toml` | N015, N083 |\n| N075 | `codex-model-provider@0.1.42` | `codex-rs/model-provider/Cargo.toml` | N013, N015, N024, N053, N062, N066, N074, N076, N079, N083, N085 |\n| N076 | `codex-models-manager@0.1.42` | `codex-rs/models-manager/Cargo.toml` | N062, N066, N079, N083, N108 |\n| N077 | `codex-network-proxy@0.1.42` | `codex-rs/network-proxy/Cargo.toml` | N110, N117, N127 |\n| N078 | `codex-ollama@0.1.42` | `codex-rs/ollama/Cargo.toml` | N045, N062, N074 |\n| N079 | `codex-otel@0.1.42` | `codex-rs/otel/Cargo.toml` | N015, N083, N123, N128, N142 |\n| N080 | `codex-plugin@0.1.42` | `codex-rs/plugin/Cargo.toml` | N038, N083, N109 |\n| N081 | `codex-prompts@0.1.42` | `codex-rs/prompts/Cargo.toml` | N041, N056, N083 |\n| N082 | `codex-protected-state@0.1.42` | `codex-rs/protected-state/Cargo.toml` | N038 |\n| N083 | `codex-protocol@0.1.42` | `codex-rs/protocol/Cargo.toml` | N062, N077 |\n| N084 | `codex-provider-auth@0.1.42` | `codex-rs/provider-auth/Cargo.toml` | N066, N074, N112 |\n| N085 | `codex-response-debug-context@0.1.42` | `codex-rs/response-debug-context/Cargo.toml` | N015 |\n| N086 | `codex-responses-api-proxy@0.1.42` | `codex-rs/responses-api-proxy/Cargo.toml` | N128 |\n| N087 | `codex-rmcp-client@0.1.42` | `codex-rs/rmcp-client/Cargo.toml` | N010, N015, N038, N048, N062, N083, N092, N121, N129 |\n| N088 | `codex-rollout-trace@0.1.42` | `codex-rs/rollout-trace/Cargo.toml` | N037, N083 |\n| N089 | `codex-rollout@0.1.42` | `codex-rs/rollout/Cargo.toml` | N056, N079, N083, N097 |\n| N090 | `codex-sandboxing@0.1.42` | `codex-rs/sandboxing/Cargo.toml` | N077, N083, N117 |\n| N091 | `codex-secret-broker-service@0.1.42` | `codex-rs/secret-broker-service/Cargo.toml` | N082, N112 |\n| N092 | `codex-secrets@0.1.42` | `codex-rs/secrets/Cargo.toml` | N056 |\n| N093 | `codex-shell-command@0.1.42` | `codex-rs/shell-command/Cargo.toml` | N083 |\n| N094 | `codex-shell-escalation@0.1.42` | `codex-rs/shell-escalation/Cargo.toml` | N083 |\n| N095 | `codex-skills-extension@0.1.42` | `codex-rs/ext/skills/Cargo.toml` | N044, N048, N050, N069, N076, N079, N083, N096, N103 |\n| N096 | `codex-skills@0.1.42` | `codex-rs/skills/Cargo.toml` | N083 |\n| N097 | `codex-state@0.1.42` | `codex-rs/state/Cargo.toml` | N056, N083, N138 |\n| N098 | `codex-tasknode-session@0.1.42` | `codex-rs/tasknode-session/Cargo.toml` | N112, N128 |\n| N099 | `codex-telegram@0.1.42` | `codex-rs/telegram/Cargo.toml` | N016, N018, N023, N038, N045, N053, N066, N074, N083, N112, N140 |\n| N100 | `codex-test-binary-support@0.1.42` | `codex-rs/test-binary-support/Cargo.toml` | N023 |\n| N101 | `codex-thread-manager-sample@0.1.42` | `codex-rs/thread-manager-sample/Cargo.toml` | N042 |\n| N102 | `codex-thread-store@0.1.42` | `codex-rs/thread-store/Cargo.toml` | N018, N056, N079, N083, N089, N097, N138 |\n| N103 | `codex-tools@0.1.42` | `codex-rs/tools/Cargo.toml` | N037, N040, N052, N054, N083, N108, N129 |\n| N104 | `codex-tui@0.1.42` | `codex-rs/tui/Cargo.toml` | N001, N016, N018, N023, N028, N030, N038, N040, N043, N048, N052, N053, N056, N058, N062, N066, N069, N073, N074, N075, N076, N079, N080, N083, N084, N089, N090, N093, N097, N098, N105, N106, N107, N109, N111, N112, N113, N114, N117, N118, N128, N129, N142 |\n| N105 | `codex-utils-approval-presets@0.1.42` | `codex-rs/utils/approval-presets/Cargo.toml` | N083 |\n| N106 | `codex-utils-cli@0.1.42` | `codex-rs/utils/cli/Cargo.toml` | N083, N093 |\n| N107 | `codex-utils-oss@0.1.42` | `codex-rs/utils/oss/Cargo.toml` | N045, N065, N074, N078 |\n| N108 | `codex-utils-output-truncation@0.1.42` | `codex-rs/utils/output-truncation/Cargo.toml` | N083 |\n| N109 | `codex-utils-plugins@0.1.42` | `codex-rs/utils/plugins/Cargo.toml` | N046, N048 |\n| N110 | `codex-utils-rustls-provider@0.1.42` | `codex-rs/utils/rustls-provider/Cargo.toml` | N130 |\n| N111 | `codex-utils-sandbox-summary@0.1.42` | `codex-rs/utils/sandbox-summary/Cargo.toml` | N083 |\n| N112 | `codex-vault@0.1.42` | `codex-rs/vault/Cargo.toml` | N092 |\n| N113 | `codex-wallet-daemon@0.1.42` | `codex-rs/wallet-daemon/Cargo.toml` | N114 |\n| N114 | `codex-wallet@0.1.42` | `codex-rs/wallet/Cargo.toml` | N128 |\n| N115 | `codex-web-search-extension@0.1.42` | `codex-rs/ext/web-search/Cargo.toml` | N015, N045, N050, N066, N074, N075, N079, N083, N103 |\n| N116 | `codex-websocket-client@0.1.42` | `codex-rs/websocket-client/Cargo.toml` | N062, N110, N130, N141, N142 |\n| N117 | `codex-windows-sandbox@0.1.42` | `codex-rs/windows-sandbox-rs/Cargo.toml` | N079, N083 |\n| N118 | `core_test_support@0.1.42` | `codex-rs/core/tests/common/Cargo.toml` | N023, N038, N045, N048, N050, N052, N060, N061, N062, N066, N074, N076, N083, N142 |\n| N119 | `hyper-rustls@0.27.7` | registry | N130, N141 |\n| N120 | `mcp_test_support@0.1.42` | `codex-rs/mcp-server/tests/common/Cargo.toml` | N066, N068, N118, N129 |\n| N121 | `oauth2@5.0.0` | registry | N128 |\n| N122 | `opentelemetry-http@0.31.0` | registry | N128 |\n| N123 | `opentelemetry-otlp@0.31.0` | registry | N122, N124, N128, N144 |\n| N124 | `opentelemetry-proto@0.31.0` | registry | N143, N144 |\n| N125 | `quinn-proto@0.11.14` | registry | N130 |\n| N126 | `quinn@0.11.9` | registry | N125, N130 |\n| N127 | `rama-tls-rustls@0.3.0-alpha.4` | registry | N130, N141 |\n| N128 | `reqwest@0.12.28` | registry | N119, N126, N130, N141 |\n| N129 | `rmcp@3.0.0` | registry | N121 |\n| N130 | `rustls@0.23.36` | registry | \u2014 (target) |\n| N131 | `sentry@0.46.1` | registry | N128 |\n| N132 | `sqlx-core@0.9.0` | registry | N130 |\n| N133 | `sqlx-macros-core@0.9.0` | registry | N132, N135, N136, N137 |\n| N134 | `sqlx-macros@0.9.0` | registry | N132, N133 |\n| N135 | `sqlx-mysql@0.9.0` | registry | N132 |\n| N136 | `sqlx-postgres@0.9.0` | registry | N132 |\n| N137 | `sqlx-sqlite@0.9.0` | registry | N132 |\n| N138 | `sqlx@0.9.0` | registry | N132, N134, N135, N136, N137 |\n| N139 | `teloxide-core@0.13.0` | registry | N128 |\n| N140 | `teloxide@0.17.0` | registry | N139 |\n| N141 | `tokio-rustls@0.26.4` | registry | N130 |\n| N142 | `tokio-tungstenite@0.28.0` | Git `0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186` | N130, N141, N145 |\n| N143 | `tonic-prost@0.14.3` | registry | N144 |\n| N144 | `tonic@0.14.3` | registry | N010, N141 |\n| N145 | `tungstenite@0.27.0` | Git `4fffad30fe373adbdcffab9545e9e9bf4f2fc19f` | N130 |\n\n\n\n## 3. Advisory and first patched Rustls release\n\n[RustSec RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html) marks **0.23.13 through 0.23.44 inclusive** affected, versions below 0.23.13 unaffected, and **>=0.23.45 patched**. Thus the locked 0.23.36 is affected and **0.23.45 is the first patched release**, confirmed by the [official release](https://github.com/rustls/rustls/releases/tag/v/0.23.45) and [maintainer advisory GHSA-2mjx-qc3c-rqvc](https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc). The advisory was issued on 14 September 2026 and rates this medium severity, CVSS 5.3.\n\nThe flaw allows some TLS 1.3 handshake content to cross an encryption-level transition within a record without rejection. The maintained advisory limits the impact: the handshake transcript remains authenticated, so this is not evidence that a network-position attacker can alter or complete an accepted handshake. A peer can cause data that should be encrypted to be accepted in plaintext. No exploit or production exposure test was performed here.\n\nThe source was pinned to [RustSec advisory-db commit e2111519ba6d14a5da59a7b2e5c8083ae8a37c01](https://github.com/rustsec/advisory-db/blob/e2111519ba6d14a5da59a7b2e5c8083ae8a37c01/crates/rustls/RUSTSEC-2026-0285.md). The [maintainer fix PR3265](https://github.com/rustls/rustls/pull/3265) and 0.23.45 release identify the handshake-alignment repair. This establishes the maintained remedy; dependency resolution and the exact proposed changes are demonstrated next.\n\n## 4. Smallest validated fix and read-only proof\n\nCommands were run from the unchanged pinned `codex-rs` workspace with the repository's Cargo **1.95.0** toolchain. No configuration override or manifest patch changed dependency selection. `CARGO_TARGET_DIR` pointed to an evidence directory outside the checkout; no build was invoked. The required command exited **0**:\n\n```console\n$ cargo update -p rustls --dry-run\n    Updating crates.io index\n     Locking 4 packages to latest compatible versions\n    Updating aws-lc-rs v1.16.2 -> v1.18.1\n    Updating aws-lc-sys v0.39.0 -> v0.45.0\n    Updating rustls v0.23.36 -> v0.23.45\n    Updating rustls-webpki v0.103.13 -> v0.103.15\nnote: pass `--verbose` to see 488 unchanged dependencies behind latest\nwarning: not updating lockfile due to dry run\n```\n\nThe exact fixed-version preview also exited **0**:\n\n```console\n$ cargo update -p rustls --precise 0.23.45 --dry-run\n    Updating crates.io index\n    Updating aws-lc-rs v1.16.2 -> v1.18.1\n    Updating aws-lc-sys v0.39.0 -> v0.45.0\n    Updating rustls v0.23.36 -> v0.23.45\n    Updating rustls-webpki v0.103.13 -> v0.103.15\nnote: pass `--verbose` to see 488 unchanged dependencies behind latest\nwarning: not updating lockfile due to dry run\n```\n\nThe smallest **validated targeted command**, for a future implementation task, is:\n\n```sh\n# Future fix, NOT executed by this read-only investigation:\ncd codex-rs\ncargo update -p rustls --precise 0.23.45\n```\n\nIt selects the first fixed Rustls release and only the three companion updates shown above: four changed package entries in Cargo.lock. The observed resolution requires no manifest changes, intermediate-library version upgrade or unrelated bulk dependency updates. No API-breaking intermediary upgrade is needed to admit the fix; source compatibility is not proved by a resolver dry run, and compilation/runtime validation remains future implementation work. \u201cUpdate Rustls alone\u201d therefore means targeting Rustls in the Cargo command; it must not be described as editing only Rustls's one lock entry.\n\nThese companion package families cannot all stay at their current locked versions: Rustls 0.23.45 declares **aws-lc-rs `^1.18`** (current 1.16.2 is too old) and **rustls-webpki `^0.103.14`** (current 0.103.13 is too old). Selected aws-lc-rs 1.18.1 in turn requires **aws-lc-sys `^0.45.0`** (current 0.39.0 is too old). Published requirements permit lower patch choices such as aws-lc-rs 1.18.0 / aws-lc-sys `^0.44.0` / rustls-webpki 0.103.14, absent any other constraint, but those are declaration floors, not a separately validated resolver result. The four concrete selected versions above are not claimed to be mathematically minimum version numbers. Cargo 1.95.0's checked `cargo update --help` does not expose `--minimal-changes`; no unsupported option or dependency-floor experiment was substituted for the required preview.\n\nPublished primary source manifests: [Rustls 0.23.45](https://docs.rs/crate/rustls/0.23.45/source/Cargo.toml), [aws-lc-rs 1.18.1](https://docs.rs/crate/aws-lc-rs/1.18.1/source/Cargo.toml), [aws-lc-rs 1.18.0](https://docs.rs/crate/aws-lc-rs/1.18.0/source/Cargo.toml). SemVer-compatible resolution proves satisfiable constraints, not runtime correctness; no application code change is indicated by resolution, and no compilation, TLS regression test, or green cargo-deny rerun is claimed.\n\nThe eventual dependency implementation must also obey the repository's [Rust dependency rule](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/codex-rs/AGENTS.md#L56): run `just bazel-lock-update` from the repository root and include the **actual** generated `MODULE.bazel.lock` delta, if any. That command was not run here because this is read-only. Rerunning the original advisory check and appropriate TLS/build checks belongs to the implementation; the separate reqwest ban remains outside scope and could still keep the aggregate CI job red.\n\n### Execution limits and unchanged repository\n\n`cargo tree --locked --offline -i rustls --workspace` succeeded on the audit host, producing **815 lines**. Cargo's standard `(*)` repeated-subtree references are preserved in the saved output. The initial broader offline invocation with `--target all` failed (exit 101) because `android_system_properties v0.1.5` was not cached; no successful all-platform feature-selected tree is claimed. The complete **Cargo.lock** analysis below supplies target-independent locked ancestry without requiring additional package downloads. That graph can include dormant optional, platform-specific, and development paths, and must not be used to assert all are reachable in a production binary.\n\nAll **9,802** repository file paths and SHA-256 values were enumerated before/after the Cargo commands, including tracked, untracked and ignored files (Git administrative metadata excluded). The maps are identical, Git status is empty both times, and HEAD is unchanged. The Cargo.lock hash remains the value given above. No repository file was edited, created or removed; no commit, PR or push was performed.\n\nEvidence integrity: the raw public CI log has SHA-256 `8127a99b57b5d4e386a04e9bbfd49185f729ac44842ed5b07923a8a89e1a1413`. All cited package manifests were checked at their exact pinned source or against the published crate archive checksum. The sole public deliverable is this consolidated report; product sessions, credentials, operator packets and local environment files are not part of it.\n", "creation_timestamp": "2026-09-26T10:53:49.000000Z"}