Skip to content

fix: bump rustls-webpki 0.103.9 -> 0.103.10 (GHSA-pwjx-qhcg-rvj4)#18785

Open
vborodaykevych wants to merge 1 commit intoastral-sh:mainfrom
vborodaykevych:fix/rustls-webpki-ghsa-pwjx-qhcg-rvj4
Open

fix: bump rustls-webpki 0.103.9 -> 0.103.10 (GHSA-pwjx-qhcg-rvj4)#18785
vborodaykevych wants to merge 1 commit intoastral-sh:mainfrom
vborodaykevych:fix/rustls-webpki-ghsa-pwjx-qhcg-rvj4

Conversation

@vborodaykevych
Copy link
Copy Markdown

@vborodaykevych vborodaykevych commented Mar 31, 2026

Patch Cargo.lock to upgrade rustls-webpki from 0.103.9 to 0.103.10, addressing the security advisory GHSA-pwjx-qhcg-rvj4.

Summary

bin/uv (rustbinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌───────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────────────────┬───────────────────────────────────────────────────────────┐
│    Library    │    Vulnerability    │ Severity │ Status │ Installed Version │       Fixed Version       │                           Title                           │
├───────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────────────────┼───────────────────────────────────────────────────────────┤
│ rustls-webpki │ GHSA-pwjx-qhcg-rvj4 │ MEDIUM   │ fixed  │ 0.103.9           │ 0.103.10, 0.104.0-alpha.5 │ webpki: CRLs not considered authoritative by Distribution │
│               │                     │          │        │                   │                           │ Point due to faulty matching...                           │
│               │                     │          │        │                   │                           │ https://github.com/advisories/GHSA-pwjx-qhcg-rvj4         │
└───────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────────────────┴───────────────────────────────────────────────────────────┘

Test Plan

Patch Cargo.lock to upgrade rustls-webpki from 0.103.9 to 0.103.10,
addressing the security advisory GHSA-pwjx-qhcg-rvj4.
@vborodaykevych vborodaykevych force-pushed the fix/rustls-webpki-ghsa-pwjx-qhcg-rvj4 branch from 4d810a7 to 58d3248 Compare March 31, 2026 21:09
@zanieb
Copy link
Copy Markdown
Member

zanieb commented Mar 31, 2026

I think we might not be using rustls-webpki for certificate validation anymore, I believe we're using rustls-platform-verifier since #18550 but I'll double check that.

@zanieb
Copy link
Copy Markdown
Member

zanieb commented Mar 31, 2026

It looks like we are not affected by this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants