From ec074ff63498c2e7311b41fd0aeca2faedaac881 Mon Sep 17 00:00:00 2001 From: Blake Gentry Date: Thu, 22 Oct 2026 09:46:13 -0500 Subject: [PATCH] update Rust TLS certificate security patches The Rust advisory check rejects the certificate verifier and trust roots that SQLx resolves because they allow paths through distrusted emSign intermediates with known private keys. Update `rustls-webpki` from 0.103.15 to 0.103.16 and `webpki-roots` from 1.0.9 to 1.0.10. These patches reject the compromised intermediates and remove the affected root while preserving existing dependency ranges. --- rust/Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rust/Cargo.lock b/rust/Cargo.lock index bd8cd5d88..5dbce0504 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -1029,9 +1029,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "ring", "rustls-pki-types", @@ -1772,9 +1772,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ]