[tobyhede]

Requested by Toby

Prepare-release PR for 2.2.5, the next 2.2.x maintenance release, cut from release/2.2.

Changes

• Bump the workspace version to 2.2.5 (Cargo.toml, Cargo.lock).
• Move the [Unreleased] fixes into a ## [2.2.5] CHANGELOG section, with its compare link, so the release workflow's verify-release check passes for tag v2.2.5.
• Set flavor: latest=false on both docker/metadata-action steps in release.yml. The default latest=auto would tag any non-prerelease semver release as cipherstash/proxy:latest, which must stay on 3.x.
• Backport security dependency updates (lockfile only): rustls 0.23.45, rustls-webpki 0.103.14, aws-lc-rs 1.18.2 / aws-lc-sys 0.46.0, rand 0.9.3 / 0.10.2, quinn-proto 0.11.15, hickory-proto / hickory-resolver 0.26.3 via reqwest 0.13.4, diesel 2.3.12 and postgres-protocol 0.6.12, with a ### Security CHANGELOG entry. tokio-postgres stays on 0.7.13 (0.7.18 conflicts through cipherstash-client); that advisory is left for 2.2.6.
• Remove the failing Multitudes notification step from release.yml, as ci: remove the Multitudes deployment notification #477 did on main.
• Document how 2.2.x releases are cut from release/2.2 in DEVELOPMENT.md.

Included in 2.2.5

• Release per-connection protocol state once PostgreSQL is done with it (fix(proxy): release per-connection protocol state when PostgreSQL is done with it (2.2.x, CIP-5015) #473).
• Reset keyset and mapping settings on DISCARD ALL and RESET (fix(proxy): reset keyset and mapping settings on DISCARD ALL and RESET (2.2.x, CIP-5021) #475).
• Keep CIPHERSTASH.* settings in step with PostgreSQL transactions (fix(proxy): keep CIPHERSTASH settings in step with PostgreSQL transactions (2.2 backport, CIP-5073) #481).
• Forward COPY ... FROM STDIN into plaintext tables, refuse it into encrypted columns (fix(proxy): forward COPY FROM STDIN into plaintext tables, refuse it into encrypted columns (2.2, CIP-5101) #483).
• Test coverage for statements beside an encrypted one in a rewritten Query (test(proxy): forward every statement beside an encrypted one in a rewritten Query (2.2) #491).
• Refuse type-check fallbacks that would forward plaintext (fix(2.2): refuse type-check fallbacks that would forward plaintext #493), with an added test for a fallback write to a table with no known columns (test(2.2): refuse a fallback write to a table with no known columns (CIP-5204) #495).

The ## [2.2.5] date is set to today; I'll move it to the tag date if tagging happens later.

Cutting the release after merge

mise run release only runs on main, so tag manually from the merged commit on release/2.2:

git tag v2.2.5 <merged sha>
git push origin v2.2.5
gh release create v2.2.5 --target release/2.2 --latest=false \
  --generate-notes --notes-start-tag v2.2.4

Acknowledgment

By submitting this pull request, I confirm that CipherStash can use, modify, copy, and redistribute this contribution, under the terms of CipherStash's choice.

---

Generated by Claude Code

[freshtonic]

Reviewed head f7df5137 against release/2.2 (5f99d7e0, which includes #493 and #495). Approved. The version bump, the CHANGELOG section and the latest=false change are correct, and the dependency updates remove 10 of the 29 advisories that cargo audit reports on the base.

I pushed the fixes for S1 and S2 to this branch as two signed commits:

• e66691ac fix(deps): backport rustls 0.23.45 to 2.2. This is a 2-line change to Cargo.lock. The CHANGELOG entry now names rustls and aws-lc-rs/aws-lc-sys, and it no longer says that 2.2.5 has every fix that 3.x ships. cargo build --workspace --all-targets --locked passes, and cargo test -p cipherstash-proxy -p eql-mapper --lib passes (283 and 79). RUSTSEC-2026-0285 is gone. The rustls advisories that remain are the same as on main.
• 103e7a86 ci: remove the Multitudes deployment notification (2.2). This is the same change as #477 on main.

This approval covers my two commits too. Please check them before you merge.

Fixed in this PR (S1 and S2)

S1. The rustls fix that main ships is not in this backport. release/2.2 locks rustls 0.23.28, which has RUSTSEC-2026-0285 ("TLS 1.3 handshake messages incorrectly accepted across encryption levels", network, no authentication). main locks 0.23.45, which fixes it. rustls is Proxy's TLS server for clients and its TLS client to PostgreSQL, so this is the most relevant advisory that remains. cargo update -p rustls --precise 0.23.45 changes only 2 lines in Cargo.lock. I built it, and the unit tests pass.

The CHANGELOG says that the update picks up "the fixes for published security advisories in those crates that Proxy 3.x already ships". That is true for the crates it names. But a reader can think that 2.2.5 has every fix that 3.x has, and it does not. Add rustls, or say which advisories stay open.

S2. The release run for v2.2.5 will end red. release.yml on 2.2 still has the "Notify Multitudes" step. #477 removed this step from main, because the endpoint has returned 500 on every run since 2026-08-17. The images are pushed before that step, so the release is published, but the run shows as failed, and the failure hides a real failure. Remove the step here too, as #477 did.

Notes (not blocking)

• postgres-protocol 0.6.8 has RUSTSEC-2026-0179 (a malicious server can send an unbounded SCRAM iteration count) and RUSTSEC-2026-0180. main does not have these. cargo update -p postgres-protocol --precise 0.6.12 resolves on 2.2, and it builds and passes the unit tests. It adds md-5 0.11 and sha2 0.11 beside the existing versions. The server is the operator's own PostgreSQL, so the risk is low. You can add it with S1 or later.
• tokio-postgres 0.7.13 has RUSTSEC-2026-0178 (panic on a short DataRow). main has 0.7.18 (#465), but on 2.2, --precise 0.7.18 fails on a libredox conflict through cipherstash-client in the integration package. It is not worth blocking the release for this. A ticket for 2.2.6 is enough.
• The lockfile update goes further than the CHANGELOG says. aws-lc-sys moves from 0.38.0 to 0.46.0, which is newer than main (0.44.0), and aws-lc-rs from 1.16.1 to 1.18.2. This fixes RUSTSEC-2026-0044 and RUSTSEC-2026-0048, so it is good. But it is a large update of the C crypto library, and it is not in the CHANGELOG. Test CI builds only x86_64. The release also builds aarch64-unknown-linux-gnu, and that build has not run on this lockfile. Before you tag, start the Release workflow on this branch with workflow_dispatch. The merge job is a dry run there, but the build job pushes untagged digests.
• The advisories that remain and that main also has (quinn-proto, h2, crossbeam-epoch, rkyv, the other rustls ones, rustls-webpki 0.103.14, webpki-root-certs) are not a 2.2 problem.

Nits

• The CHANGELOG date is 2026-10-26. Update it if the tag goes out on another day.

What I checked and found correct

• Version. The workspace version is 2.2.5, and cipherstash-proxy, eql-mapper-macros and showcase are 2.2.5 in Cargo.lock. verify-release reads the first version = line of Cargo.toml and looks for ## [2.2.5] in the CHANGELOG. Both match.
• latest=false. A release event runs the workflow file from the tag, so the 2.2 release.yml is used. The merge step makes :2.2.5 ({{version}}) and :2.2 ({{major}}.{{minor}}), and not :latest. On the build step the flavor changes only labels, so it does no harm. GitHub's "Latest" is v3.0.1 now, and --latest=false in DEVELOPMENT.md keeps it there.
• The CHANGELOG. The 2.2.5 section has #473, #475, #481, #483 and #493. It includes the sentence about plaintext predicates that I asked for in my review of #493. #491 and #495 add tests only.
• Cargo.toml. No dependency requirement changed. The updates are in the lockfile only.
• Signatures. All 3 commits are verified on GitHub.

What I ran

• cargo audit on the base, this PR and main: 29, 19 and 17 advisories.
• cargo update -p rustls --precise 0.23.45 and -p postgres-protocol --precise 0.6.12, then cargo build and cargo test -p cipherstash-proxy --lib: 282 of 283 passed. The failure, config::tandem::tests::prometheus_config, is the known environment race. I reverted the lockfile after the run.
• CI: all 4 checks pass.

[tobyhede]

Thanks @freshtonic. I checked your two commits and they're fine. I pushed one more signed commit, 07ffc15: postgres-protocol goes to 0.6.12 for RUSTSEC-2026-0179/0180, with the CHANGELOG entry updated. It's lockfile only. It builds with --locked, and the proxy and mapper unit tests pass (283 and 79). tokio-postgres stays for 2.2.6. I'll do the aarch64 workflow_dispatch run and the date update before tagging.

---

Generated by Claude Code

[tobyhede]

All four Test jobs fail on 49c7057. Unit tests pass, but in the integration stage the proxy container never accepts connections on localhost:6432 ("Unable to connect to localhost:6432 after 20 attempts"). 303f809, which has the same tree as 07ffc15, was green, so the cause is in the 7 backport commits on top of it. The most likely one is the dependency update e8af865 (tokio-postgres 0.7.18, rustls 0.23.46, tokio 1.51.6, socket2 all). The job output doesn't include the container's logs, so docker logs proxy after mise run proxy:up should show the startup error. I'm not re-running: it fails the same way on all four, so it isn't a flake.

---

Generated by Claude Code