Skip to content

fix(deps): bump rustls-webpki and webpki-root-certs for RUSTSEC-2026-0382/0383 - #95

Open
TerryHowe wants to merge 1 commit into
oras-project:mainfrom
TerryHowe:fix/bump-webpki-advisories
Open

TerryHowe wants to merge 1 commit into
oras-project:mainfrom
TerryHowe:fix/bump-webpki-advisories

Conversation

@TerryHowe

Copy link
Copy Markdown
Member

Two new RustSec advisories make cargo deny (advisories) fail on main and on every open PR:

  • RUSTSEC-2026-0382: rustls-webpki 0.103.15. Certificate verification may accept distrusted intermediates. Fixed in 0.103.16.
  • RUSTSEC-2026-0383: webpki-root-certs 1.0.9. The bundled roots trust distrusted emSign intermediates. Fixed in 1.0.10.

This PR updates only Cargo.lock, the same change cargo update -p rustls-webpki -p webpki-root-certs makes. Both bumps are patch releases, and their dependency lists are unchanged.

This unblocks the open Dependabot PRs #88–#94.

…0382/0383

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant