From a27286f33443669d94023f74dcb99db66b26bfdf Mon Sep 17 00:00:00 2001
From: Xuanwo <github@xuanwo.io>
Date: Tue, 15 Sep 2026 05:12:52 +0000
Subject: [PATCH] fix: update rustls to address RUSTSEC-2026-0285 (#25309)

## Which issue does this PR close?

Fixes the [security audit
failure](https://github.com/apache/datafusion/actions/runs/34914826729/job/104210077720)
caused by
[RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html).

## Rationale for this change

The locked rustls 0.23.39 accepts TLS 1.3 handshake messages across
encryption level boundaries and now fails the security audit. Rustls
0.23.45 fixes the vulnerability.

## What changes are included in this PR?

Update rustls to 0.23.45 in Cargo.lock, together with its required
aws-lc-rs, aws-lc-sys, and rustls-webpki dependency updates.

## What is the testing strategy for this PR?

The existing security audit reproduces the vulnerability with the
original lockfile and passes with the updated lockfile:

```sh
cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195
```

The workspace extended tests also pass:

```sh
RUST_BACKTRACE=1 cargo test --profile ci \
    --exclude datafusion-examples --exclude datafusion-benchmarks --exclude datafusion-cli \
    --workspace --lib --tests --bins \
    --features avro,json,backtrace,extended_tests,recursive_protection,parquet_encryption
```

Also passed `cargo fmt --all`, `cargo clippy --all-targets
--all-features -- -D warnings`, and `./dev/rust_lint.sh`.

## Are there any user-facing changes?

Builds using the checked-in lockfile use the patched TLS implementation.
No DataFusion API changes.

(cherry picked from commit 745b1ec218d4836ea936a8a89d0cbcc691bbcc05)
---
 Cargo.lock | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 141d5b6fdddb6..5ea0f9673cb50 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -586,9 +586,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.3"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -596,14 +596,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.40.0"
+version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -5379,9 +5380,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.39"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c2c118cb077cca2822033836dfb1b975355dfb784b5e8da48f7b6c5db74e60e"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -5417,9 +5418,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "aws-lc-rs",
  "ring",