[sanity]

Problem

Following the eMudhra intermediate-key compromise (disclosed 2026-10-17), the earlier webpki-roots 1.0.11 bump dropped the distrusted eMudhra roots. rustls-webpki 0.103.16 (released 2026-10-20) adds a second, independent layer: it rejects any certificate path containing the specific distrusted intermediate public keys, regardless of which root store is in use (including OS stores loaded through rustls-native-certs).

Approach

Lockfile only: cargo update -p rustls-webpki to 0.103.16. No code changes.

Testing

Existing CI. The diff is the rustls-webpki version and checksum lines in Cargo.lock.

[AI-assisted - Claude]

https://claude.ai/code/session_01Xxpwzw71GZJYts7ENMXYX2

[sanity]

Review (Light tier: lockfile-only patch bump). One independent adversarial Claude reviewer read the diff: only the rustls-webpki version/checksum lines change (plus version-qualified references where the lock has two versions), the checksum matches the crate on static.crates.io (4443b1b6...8b281 for 0.103.16; f5f280bb...df171 for webpki-roots 1.0.11 where applicable), and no lockfile in the repo still resolves rustls-webpki 0.103.x below 0.103.16 or webpki-roots 1.x below 1.0.11. No findings.

[AI-assisted - Claude]