Take rustls past RUSTSEC-2026-0285

[vmillet-dev]

Cargo advisories and licenses went red, and not because of the PR it went red
on. rustls 0.23.42 has been in the lockfile since before today; the advisory
was published between main's last Security run this morning and now, and #126
happened to be the first run after it.

error[vulnerability]: TLS 1.3 handshake messages incorrectly accepted across
                      encryption level boundaries
  rustls 0.23.42  →  RUSTSEC-2026-0285
  reached through: tauri-plugin-updater → reqwest → {hyper-rustls, tokio-rustls,
                                                     rustls-platform-verifier}

The handshake transcript stays authenticated, so a network-position attacker
cannot alter or complete a handshake. The practical effect is narrower: a peer
could send in plaintext what should have been encrypted, and rustls would not
reject the connection. Functionally the same bug as Go's CVE-2025-61730.

tauri-plugin-updater is the only thing in this tree that speaks TLS.

⚠️ Why both packages are named on one command

cargo update -p rustls alone stops at 0.23.43, still below the fix:

Updating rustls v0.23.42 -> v0.23.43 (available: v0.23.45)

0.23.45 requires webpki ^0.103.14 and the lockfile held 0.103.13. A
single-package update is conservative and will not move a sibling to satisfy the
one it was asked about, so it falls back to the newest release that accepts what
is already locked — 0.23.43, whose requirement is ^0.103.5. Naming both lets
the resolver move them together:

cargo update -p rustls -p rustls-webpki
Locking 2 packages to latest Rust 1.88 compatible versions

Lockfile only. No --precise pin and no MSRV change — every crate involved
declares rust-version = "1.71", so rust-version = "1.88" was never the gate,
and raising it as far as 1.93 changes nothing. Cargo's "latest Rust 1.88
compatible version" line is what made it look like one.

Checked locally

cargo test all green, cargo clippy --all-targets -D warnings and cargo fmt --check clean.

🤖 Generated with Claude Code

[vmillet-dev]

Folded into #126 — the advisory is what turned that PR's Security job red, so the fix belongs on the branch that has to go green.