<!-- entire-trail-link-start -->
https://entire.io/gh/jdx/mise/trails/724
<!-- entire-trail-link-end -->

`cargo deny check` now fails on rustls 0.23.45: its `Debug` impls for
`Tls12ClientSessionValue` and `Tls13ClientSessionValue` print the TLS
1.2 master secret or TLS 1.3 resumption PSK (rustls/rustls#3299, fixed
in 0.23.46). The advisory is not yet numbered (`RUSTSEC-0000-0000`).
This makes `trusted / lint` red on every open PR.

mise does not format those values with `Debug`; the dependency path is
the AWS SDK's HTTP client, so the exposure is limited to anything that
would log a custom session store's values. The bump is a lockfile-only
change (`cargo update -p rustls --precise 0.23.46`; it also moves
rustls's `getrandom` dependency from 0.4.3 to 0.3.4), with no
`Cargo.toml` change.

Validation: `cargo check --bin mise` builds. I could not run `cargo
deny` locally (the shim has no installed version here), so CI's `trusted
/ lint` is the check.

*AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5;
version: claude-code_2-1-295_agent.*

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Patch-level TLS library upgrade with no application code changes;
reduces secret-leak risk in debug output rather than changing runtime
TLS behavior.
> 
> **Overview**
> Bumps **rustls** from `0.23.45` to `0.23.46` in `Cargo.lock` only (no
`Cargo.toml` edits), addressing a pending RustSec issue where `Debug` on
TLS session types could leak the TLS 1.2 master secret or TLS 1.3
resumption PSK—fixing failing `cargo deny` / `trusted / lint` on PRs.
> 
> The lockfile refresh also pins **tempfile**’s transitive **getrandom**
dependency to `0.3.4` instead of `0.4.3` as part of the same `cargo
update -p rustls` resolution.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
e74cbfd. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Sonnet 5.5 <[email protected]>