From 86ff3670c0d47c8a8921718339c6357f0a3e5d4c Mon Sep 17 00:00:00 2001 From: Moudy Date: Wed, 22 Apr 2026 16:02:56 +0200 Subject: [PATCH] fix: bump rustls-webpki to 0.103.13 for RUSTSEC-2026-0104 Upstream advisory, reachable panic in certificate revocation list parsing via `BorrowedCertRevocationList::from_der` / `OwnedCertRevocationList::from_der`. Unrelated to this PR, dropped into the advisory DB since the last green CI run and broke the `deny` job. Fix is the recommended version bump. --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7182f9d1..ca46abde 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -7143,9 +7143,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.12" +version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06" +checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ "ring", "rustls-pki-types",