From ff3820aba2f218c75fae6b542b6067580e9f4ec4 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Mon, 26 Oct 2026 21:07:39 -0700 Subject: [PATCH] chore(deps): bump rustls-webpki and webpki-roots for the emSign distrust Eight eMudhra/emSign TLS intermediate CAs had private keys that can be computed from their certificates. rustls-webpki 0.103.16 (RUSTSEC-2026-0383, CVE-2026-111943) rejects chains through those keys, and webpki-roots 1.0.10 drops emSign ECC Root CA - G3. cargo update -p rustls-webpki --precise 0.103.16 cargo update -p webpki-roots@1.0.2 --precise 1.0.10 Signed-off-by: Kevin Wang --- Cargo.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a0a2280c..54c055ca 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2633,7 +2633,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976" dependencies = [ "data-encoding", - "syn 2.0.104", + "syn 1.0.109", ] [[package]] @@ -4306,7 +4306,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower-service", - "webpki-roots 1.0.2", + "webpki-roots 1.0.10", ] [[package]] @@ -6993,7 +6993,7 @@ dependencies = [ "wasm-bindgen", "wasm-bindgen-futures", "web-sys", - "webpki-roots 1.0.2", + "webpki-roots 1.0.10", ] [[package]] @@ -7474,9 +7474,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.4" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring 0.17.14", "rustls-pki-types", @@ -9293,14 +9293,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.2", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.2" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ]