[scarmuega]

Bumps the TLS trust crates in Cargo.lock so cshell no longer trusts the distrusted eMudhra roots and picks up the fixed rustls-webpki verifier:

• rustls-webpki 0.103.8 → 0.103.16
• webpki-roots 1.0.4 → 1.0.10
• webpki-root-certs 1.0.4 → 1.0.10 (the 0.26.11 re-export is unchanged)

Only Cargo.lock changes; no other crate moves.

Verification (local, Rust 1.93): cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings and cargo test --all-targets --all-features all pass. The trust-floor lockfile check prints at floor.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5e732461-7f1c-4398-9866-80012b75fa23

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[scarmuega]

QA review record

• Pass: first pass, head 5a06937. The diff is 93b36fe..5a06937: Cargo.lock only, 7 lines added and 7 removed. Size class: small.
• Lenses run: fresh eyes (one subagent). Correctness, conformance, dependencies and test adequacy, run together in a second subagent with the plan. Independence is degraded because those four lenses shared one context instead of one each. That is proportionate for a three-crate patch bump in the lockfile.
• Lenses skipped: state and resources, security, errors and observability, compatibility and persistence. The diff changes no code, API, config or stored format. Only the versions of TLS trust crates move.
• Verified:
  • Only three crates move: rustls-webpki 0.103.8 → 0.103.16, webpki-roots 1.0.4 → 1.0.10, and webpki-root-certs 1.0.4 → 1.0.10. The 0.26.11 re-export now points at 1.0.10.
  • The trust-floor check prints at floor.
  • The crates.io checksums match. No version is yanked. No licence is new.
  • The minimum Rust of the new versions is 1.71, below the crate's rust-version of 1.88.
  • cargo tree --locked resolves. rustls-pki-types 1.13.0 satisfies ^1.12.
• CI at 5a06937: green. That covers fmt, clippy, the tests on ubuntu, macOS and Windows, the integration tests, and the release plan.
• Findings: none confirmed, none plausible, none refuted.
• PR comments: the only one is CodeRabbit's "draft not reviewed" notice, which needs no action.
• Normalization: nothing to do. There are no comments in the diff.

[scarmuega]

Merge observed.

Plan: plans/emudhra-distrust-rust-cshell.md
QA-approved head: 5a06937597a1ec52582e47f45a7151af6190f2a5

Trellis will verify the human merge evidence, adopt the domain pin, and retire the plan. No further merge action is needed.