Skip to content

Prepare 0.15.2 release #637

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cpu merged 2 commits into from
Apr 15, 2026
+39 −14
Merged

Prepare 0.15.2 release #637

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6a40adc
Cargo: update semver compatible deps
cpu Apr 15, 2026
586a899
prepare 0.15.2
cpu Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,30 @@
# Changelog

## 0.15.2 (2026-04-15)

This is a minor release with two security fixes. It also updates `rustls` to
[0.23.38](https://github.com/rustls/rustls/releases/tag/v%2F0.23.38).

### Security

This update addresses
[RUSTSEC-2026-0098](https://rustsec.org/advisories/RUSTSEC-2026-0098.html) and
[RUSTSEC-2026-0099](https://rustsec.org/advisories/RUSTSEC-2026-0099.html);
two security issues affecting name constraint checking with the webpki
certificate verifiers. Both issues are reachable only after signature
verification and require misissuance to exploit.

These low-impact vulnerabilities only affect users of the
`rustls_web_pki_[server|client]_cert_verifier_builder` APIs.

### Added

* `rustls_client_config_builder_set_check_selected_alpn()`
* Allows configuring a to-be-built client config to allow skipping a check
that the server's selected ALPN was in the list offered by the client. This
defaults to true, matching the behavior before the option to skip the check
was available.

## 0.15.1 (2026-03-13)

This is a minor release with one security fix. It updates `rustls` to
Expand Down
22 changes: 11 additions & 11 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion librustls/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[package]
name = "rustls-ffi"
# Keep in sync with defines in cbindgen.toml
version = "0.15.1"
version = "0.15.2"
license = "Apache-2.0 OR ISC OR MIT"
readme = "../README-crates.io.md"
description = "Rustls bindings for non-Rust languages"
Expand Down
2 changes: 1 addition & 1 deletion librustls/cbindgen.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ after_includes = """

#define RUSTLS_VERSION_MAJOR 0
#define RUSTLS_VERSION_MINOR 15
#define RUSTLS_VERSION_PATCH 1
#define RUSTLS_VERSION_PATCH 2

/**
* This gives each version part 8 bits, and leaves the 8 least significant bits
Expand Down
2 changes: 1 addition & 1 deletion librustls/src/rustls.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

#define RUSTLS_VERSION_MAJOR 0
#define RUSTLS_VERSION_MINOR 15
#define RUSTLS_VERSION_PATCH 1
#define RUSTLS_VERSION_PATCH 2

/**
* This gives each version part 8 bits, and leaves the 8 least significant bits
Expand Down