From 7d2ad80247c46049cd84da99d6280c33b429b249 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Wed, 14 Oct 2026 17:22:48 -0700
Subject: [PATCH] Patch rustls and move to Go 1.26.9 for new security
 advisories

rustls 0.23.45 -> 0.23.46 in rust/Cargo.lock clears RUSTSEC-2026-0346,
-0347, -0348 and -0349, all patched in >=0.23.46. The conformance runner
workspace doesn't depend on rustls.

The go/go.mod toolchain moves from go1.26.8 to go1.26.9, which carries
the net/http fixes for GO-2026-6617 and GO-2026-6613. Every setup-go step
reads its version from go/go.mod, so CI follows.
---
 go/go.mod       | 2 +-
 rust/Cargo.lock | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go/go.mod b/go/go.mod
index ee69350a7..d163b22e6 100644
--- a/go/go.mod
+++ b/go/go.mod
@@ -2,7 +2,7 @@ module github.com/basecamp/basecamp-sdk/go
 
 go 1.26.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require (
 	github.com/basecamp/actioncable-go v1.2.0
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 5c825b458..f67222931 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -1282,9 +1282,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "once_cell",