fix: update rustls-webpki 0.103.9 → 0.103.10 (security alert #11)#145
Merged
fix: update rustls-webpki 0.103.9 → 0.103.10 (security alert #11)#145
Conversation
Patches rustls-webpki from 0.103.9 to 0.103.10 to resolve Dependabot alert #11 (medium severity): > webpki: certificate revocation enforcement bug > Affected: >= 0.101.0, < 0.103.10 | Fixed: 0.103.10 This is a Cargo.lock-only change (patch version bump), no API changes. The 0.103.9 version is a transitive dep via reqwest → rustls 0.23.x. Note: rustls-webpki 0.102.8 (via libsql → hyper-rustls 0.25 → rustls 0.22) also remains vulnerable but requires libsql upstream to update to hyper-rustls 0.27+. No patch available at this time.
|
No reviewable files after applying ignore patterns. |
GoDoming
approved these changes
Mar 23, 2026
Member
GoDoming
left a comment
GoDoming
left a comment
There was a problem hiding this comment.
Security patch with green CI. Merging per maintenance protocol.
This was referenced Mar 23, 2026
GoDoming
pushed a commit
that referenced
this pull request
Mar 23, 2026
Fixes certificate revocation enforcement bug in rustls-webpki. CVE: GHSA-pwjx-qhcg-rvj4 Severity: medium Same fix applied to main via PR #145.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix
Resolves Dependabot alert #11 (medium severity):
Changes
rustls-webpki:0.103.9→0.103.10inCargo.lockRemaining Vulnerability
rustls-webpki 0.102.8(vialibsql → hyper-rustls 0.25 → rustls 0.22) is also within the vulnerable range but cannot be patched without libsql upstream updating tohyper-rustls 0.27+. Currently libsql 0.9.30 (latest) still pinshyper-rustls ^0.25. This is being tracked.cc @GoZumie