Repository navigation
Update rustls-webpki and webpki-roots for RUSTSEC-2026-0381 and 0382 - #287
Merged
Merged
Conversation
…rust emSign RUSTSEC-2026-0381 and RUSTSEC-2026-0382 fail cargo-deny, a required check, so no pull request could merge until both were updated.
|
No findings. The full review is encrypted in this run's |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two advisories landed against crates already in the lock, and cargo-deny is a required check, so nothing could merge. RUSTSEC-2026-0382 covers rustls-webpki 0.103.15 accepting certificate paths through the distrusted emSign intermediates, and RUSTSEC-2026-0381 covers webpki-roots 1.0.9 still bundling the emSign ECC root. Both come in through reqwest and hyper-rustls. This takes rustls-webpki 0.103.16 and webpki-roots 1.0.10 with
cargo update -p rustls-webpki -p webpki-roots. Those two versions are the whole lock change, and no package is added.Verified locally: 3,813 tests passed, and clippy, fmt and cargo deny are clean.