Patch rustls and move to Go 1.26.9 for new security advisories

[jeremy]

Main's Security run has been red since 2026-10-12, and every PR's checks with it: cargo deny fails on new rustls advisories and govulncheck on new Go stdlib net/http advisories. Two lines fix both.

Advisory	Where	Fix
RUSTSEC-2026-0346 — Debug impls for client session values expose TLS secrets	rust/Cargo.lock rustls 0.23.45	rustls 0.23.46 (patched >=0.23.46)
RUSTSEC-2026-0347 — buffered application data sent to outer server after ECH rejection	same	same
RUSTSEC-2026-0348 — Brotli cert decompression can allocate 1 GiB pre-auth	same	same
RUSTSEC-2026-0349 — unauthenticated ServerHello can downgrade later connections to classical key exchange	same	same
GO-2026-6617 — HTTP/2 server crash from HPACK encoder race in net/http	go/go.mod toolchain go1.26.8	toolchain go1.26.9
GO-2026-6613 — net/http	same	same

• Rust: cargo update -p rustls in rust/; only rustls moved (hyper-rustls, tokio-rustls, rustls-platform-verifier, rustls-webpki already accept 0.23.46). The conformance/runner/rust workspace doesn't depend on rustls and already passes cargo deny.
• Go: go/go.mod's toolchain line was the only 1.26.8 pin. Every setup-go step reads go-version-file: go/go.mod; .mise.toml floats on 1.26, and the other go.mod files and go.work carry no toolchain line. No Dockerfiles pin Go.

Verified locally (each gated on exit status): make rs-check (incl. cargo deny over both workspaces), govulncheck ./... under go1.26.9 ("No vulnerabilities found"), make go-check, conformance-runner-tests-{go,rust}, conformance-{go,rust} (312/312 Rust; 310 pass, 2 skipped Go).

---

Summary by cubic

Fixes the security checks that have been red since 2026-10-12 by updating rustls to 0.23.46 and the Go toolchain to 1.26.9. These clear four new rustls advisories (RUSTSEC-2026-0346 through -0349) and two Go net/http advisories (GO-2026-6617 and GO-2026-6613) that were failing cargo deny and govulncheck on every PR.

Bug Fixes

• cargo update -p rustls in rust/; only rustls moved, and the conformance runner workspace doesn't depend on it.
• go/go.mod's toolchain line was the only 1.26.8 pin; every setup-go step reads its version from that file.

^{Written for commit 7d2ad80. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T00:33:11.559128Z	7d2ad80	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The changes are narrowly scoped security patch updates, with reported successful validation and no unresolved findings.

0 open findings

What changed in this PR

Updates Rust and Go security patch versions to address advisories blocking the SDK’s security checks.

Changes:

• Updates rustls from 0.23.45 to 0.23.46 and refreshes its checksum.
• Updates the Go toolchain from 1.26.8 to 1.26.9.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
rust/​Cargo.lock	Locks the patched rustls version and checksum.
go/​go.mod	Selects the patched Go toolchain.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.