From 065058a5eff867b15963654aaa0a2f0c3742dbe8 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 6 Aug 2026 06:23:33 +0000 Subject: [PATCH] chore(deps): bump openssl to 0.10.81 and rustls-webpki to 0.103.13 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Discharges the two dependabot PRs open since 2026-06-23 (#90, #88). Both are transitive — openssl via native-tls, rustls-webpki via rustls — so this is a lockfile-only change; `cargo update -p openssl -p rustls-webpki` resolves to exactly the versions those PRs propose, plus openssl-sys 0.9.109 -> 0.9.117 as openssl's companion. Verified against OSV rather than the release notes, which undercount: rustls-webpki 0.103.4 8 advisories -> 0.103.13 CLEAN openssl 0.10.73 8 advisories -> 0.10.81 CLEAN openssl-sys 0.9.109 clean -> 0.9.117 clean That is 16 cleared, including GHSA-82j2-j2ch-gfr8 (reachable panic parsing a CRL) and RUSTSEC-2026-0049 (CRLs not authoritative by distribution point; affects >=0.102.0-alpha.0 <0.103.10, so 0.103.4 was squarely in range). `cargo check --workspace --locked --all-targets` passes. The 7 xtask warnings it prints are pre-existing visibility lints in wasm_event_bus, untouched here. Worth recording why these sat for seven weeks looking harmless: the `deps` lane has been green over all 16 of them, because it scans nothing. `.gitignore:7` lists `Cargo.lock` while the file is tracked — inert for git, but osv-scanner applies the pattern literally and skips the repo's only lockfile, so the last run reported `0 Extract calls` / `No package sources found`, and `--allow-no-lockfiles` turned that into a pass. Filed separately; this bump lands first so the scan does not go straight from blind to red. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019kJtPPYMW39vbkTFvEpexe --- Cargo.lock | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index fd65c1b..4c94c0d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2646,15 +2646,14 @@ checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad" [[package]] name = "openssl" -version = "0.10.73" +version = "0.10.81" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8" +checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45" dependencies = [ "bitflags 2.9.1", "cfg-if", "foreign-types", "libc", - "once_cell", "openssl-macros", "openssl-sys", ] @@ -2678,9 +2677,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e" [[package]] name = "openssl-sys" -version = "0.9.109" +version = "0.9.117" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571" +checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" dependencies = [ "cc", "libc", @@ -3227,9 +3226,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.4" +version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc" +checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ "ring", "rustls-pki-types",