Repository navigation
Commit 7c166f8
[58_maintenance] chore: update webpki dependencies to fix cargo audit CI (#11794)
# Which issue does this PR close?
- Part of #11665 (58.4.1 release)
# Rationale for this change
The `Audit` job fails on `58_maintenance` because two advisories were
published against versions pinned in the committed `Cargo.lock`:
- RUSTSEC-2026-0382: `rustls-webpki` 0.103.15 (fixed in 0.103.16)
- RUSTSEC-2026-0381: `webpki-roots` 1.0.9 (fixed in 1.0.10)
Reproduced locally by running the CI `cargo audit` invocation (with the
workflow's `--ignore` list) against the branch, which reports exactly
these two vulnerabilities.
This is the same fix as #11752 on `main` and #11793 on `59_maintenance`.
# What changes are included in this PR?
Update only the two flagged crates in `Cargo.lock`:
```
cargo update -p rustls-webpki -p webpki-roots
```
Verified locally that the CI `cargo audit` invocation passes afterwards,
and that the lockfile resolves with `cargo +1.85.0 metadata --locked`.
Both new versions have `rust-version = "1.71"`, below the workspace MSRV
of 1.85.
# Are these changes tested?
CI
# Are there any user-facing changes?
No. This only affects the lockfile used for workspace builds and CI.
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>1 parent 3e4fdc7 commit 7c166f8
1 file changed
Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments