Update webpki crates

[tpoliaw]

To patch RUSTSEC-2026-0099

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.27%. Comparing base (a2eb617) to head (e915a80).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #108   +/-   ##
=======================================
  Coverage   49.27%   49.27%           
=======================================
  Files          13       13           
  Lines         621      621           
=======================================
  Hits          306      306           
  Misses        315      315           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ZohebShaikh]

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1060 security advisories (from /home/zoheb/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (293 crate dependencies)
Crate:     bytes
Version:   1.10.1
Title:     Integer overflow in `BytesMut::reserve`
Date:      2026-02-03
ID:        RUSTSEC-2026-0007
URL:       https://github.com/advisories/GHSA-434x-w66g-qw3r
Solution:  Upgrade to >=1.11.1
Dependency tree:
bytes 1.10.1
├── tungstenite 0.28.0
│   └── tokio-tungstenite 0.28.0
│       └── axum 0.8.6
│           ├── glazed 0.0.0
│           └── async-graphql-axum 7.0.17
│               └── glazed 0.0.0
├── tower-http 0.6.6
│   └── reqwest 0.12.24
│       └── glazed 0.0.0
├── tokio-util 0.7.17
│   ├── reqwest 0.12.24
│   ├── h2 0.4.12
│   │   └── hyper 1.7.0
│   │       ├── reqwest 0.12.24
│   │       ├── hyper-util 0.1.17
│   │       │   ├── reqwest 0.12.24
│   │       │   ├── hyper-rustls 0.27.7
│   │       │   │   └── reqwest 0.12.24
│   │       │   ├── httpmock 0.8.2
│   │       │   │   └── glazed 0.0.0
│   │       │   └── axum 0.8.6
│   │       ├── hyper-rustls 0.27.7
│   │       ├── httpmock 0.8.2
│   │       └── axum 0.8.6
│   └── async-graphql-axum 7.0.17
├── tokio 1.48.0
│   ├── tower 0.5.2
│   │   ├── tower-http 0.6.6
│   │   ├── reqwest 0.12.24
│   │   ├── glazed 0.0.0
│   │   └── axum 0.8.6
│   ├── tokio-util 0.7.17
│   ├── tokio-tungstenite 0.28.0
│   ├── tokio-stream 0.1.17
│   │   └── async-graphql-axum 7.0.17
│   ├── tokio-rustls 0.26.4
│   │   ├── reqwest 0.12.24
│   │   └── hyper-rustls 0.27.7
│   ├── reqwest 0.12.24
│   ├── quinn 0.11.9
│   │   └── reqwest 0.12.24
│   ├── hyper-util 0.1.17
│   ├── hyper-rustls 0.27.7
│   ├── hyper 1.7.0
│   ├── httpmock 0.8.2
│   ├── h2 0.4.12
│   ├── glazed 0.0.0
│   ├── axum 0.8.6
│   └── async-graphql-axum 7.0.17
├── reqwest 0.12.24
├── quinn-proto 0.11.13
│   └── quinn 0.11.9
├── quinn 0.11.9
├── multer 3.1.0
│   └── async-graphql 7.0.17
│       ├── glazed 0.0.0
│       └── async-graphql-axum 7.0.17
├── hyper-util 0.1.17
├── hyper 1.7.0
├── httpmock 0.8.2
├── http-body-util 0.1.3
│   ├── reqwest 0.12.24
│   ├── httpmock 0.8.2
│   ├── glazed 0.0.0
│   ├── axum-core 0.5.5
│   │   └── axum 0.8.6
│   └── axum 0.8.6
├── http-body 1.0.1
│   ├── tower-http 0.6.6
│   ├── reqwest 0.12.24
│   ├── hyper-util 0.1.17
│   ├── hyper 1.7.0
│   ├── http-body-util 0.1.3
│   ├── axum-core 0.5.5
│   └── axum 0.8.6
├── http 1.3.1
│   ├── tungstenite 0.28.0
│   ├── tower-http 0.6.6
│   ├── reqwest 0.12.24
│   ├── multer 3.1.0
│   ├── hyper-util 0.1.17
│   ├── hyper-rustls 0.27.7
│   ├── hyper 1.7.0
│   ├── httpmock 0.8.2
│   ├── http-body-util 0.1.3
│   ├── http-body 1.0.1
│   ├── headers-core 0.3.0
│   │   └── headers 0.4.1
│   │       └── httpmock 0.8.2
│   ├── headers 0.4.1
│   ├── h2 0.4.12
│   ├── axum-core 0.5.5
│   ├── axum 0.8.6
│   └── async-graphql 7.0.17
├── headers 0.4.1
├── h2 0.4.12
├── axum-core 0.5.5
├── axum 0.8.6
├── async-graphql-value 7.0.17
│   ├── async-graphql-parser 7.0.17
│   │   ├── async-graphql-derive 7.0.17
│   │   │   └── async-graphql 7.0.17
│   │   └── async-graphql 7.0.17
│   └── async-graphql 7.0.17
├── async-graphql-axum 7.0.17
└── async-graphql 7.0.17

Crate:     quinn-proto
Version:   0.11.13
Title:     Denial of service in Quinn endpoints
Date:      2026-03-09
ID:        RUSTSEC-2026-0037
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0037
Severity:  8.7 (high)
Solution:  Upgrade to >=0.11.14
Dependency tree:
quinn-proto 0.11.13
└── quinn 0.11.9
    └── reqwest 0.12.24
        └── glazed 0.0.0

Crate:     rustls-webpki
Version:   0.103.8
Title:     CRLs not considered authoritative by Distribution Point due to faulty matching logic
Date:      2026-03-20
ID:        RUSTSEC-2026-0049
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0049
Solution:  Upgrade to >=0.103.10
Dependency tree:
rustls-webpki 0.103.8
└── rustls 0.23.35
    ├── tokio-rustls 0.26.4
    │   ├── reqwest 0.12.24
    │   │   └── glazed 0.0.0
    │   └── hyper-rustls 0.27.7
    │       └── reqwest 0.12.24
    ├── reqwest 0.12.24
    ├── quinn-proto 0.11.13
    │   └── quinn 0.11.9
    │       └── reqwest 0.12.24
    ├── quinn 0.11.9
    └── hyper-rustls 0.27.7

Crate:     rustls-webpki
Version:   0.103.8
Title:     Name constraints for URI names were incorrectly accepted
Date:      2026-04-14
ID:        RUSTSEC-2026-0098
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0098
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

Crate:     rustls-webpki
Version:   0.103.8
Title:     Name constraints were accepted for certificates asserting a wildcard name
Date:      2026-04-14
ID:        RUSTSEC-2026-0099
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0099
Solution:  Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6

Crate:     rustls-webpki
Version:   0.103.8
Title:     Reachable panic in certificate revocation list parsing
Date:      2026-04-22
ID:        RUSTSEC-2026-0104
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0104
Solution:  Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7

Crate:     rand
Version:   0.9.2
Warning:   unsound
Title:     Rand is unsound with a custom logger using `rand::rng()`
Date:      2026-04-09
ID:        RUSTSEC-2026-0097
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0097
Dependency tree:
rand 0.9.2
├── tungstenite 0.28.0
│   └── tokio-tungstenite 0.28.0
│       └── axum 0.8.6
│           ├── glazed 0.0.0
│           └── async-graphql-axum 7.0.17
│               └── glazed 0.0.0
└── quinn-proto 0.11.13
    └── quinn 0.11.9
        └── reqwest 0.12.24
            └── glazed 0.0.0

error: 6 vulnerabilities found!
warning: 1 allowed warning found

There are lots of other vulnerabilities as well, all can be fixed by just
cargo update