eMudhra CA response: bump rustls-webpki to 0.103.16 (RUSTSEC-2026-0382)

Merged
MI
5d ago
+2-2

Summary

Follow-up to #31. Fixes RUSTSEC-2026-0382 (CVE-2026-111943): rustls-webpki < 0.103.16 accepts certificate paths that pass through the 8 distrusted emSign (eMudhra) intermediate keys, whose private keys are now public. 0.103.16 rejects paths containing those keys.

#31 missed it because it only bumped the trust-anchor crate (webpki-root-certs 1.0.10). Removing the roots does not cover the intermediates: the CA-distrust key blocklist lives in rustls-webpki's path builder, so that crate needs its own bump.

Changes

  • Cargo.lock: rustls-webpki 0.103.13 -> 0.103.16 (version + checksum only, 2 lines). No other package moves.
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"

Note: a plain cargo update -p rustls-webpki --precise 0.103.16 also re-unified several windows-sys 0.52.0 dependents onto 0.60.2. To keep the diff to the one crate, the entry was edited to the exact crates.io version/checksum and checked with cargo metadata --locked (lockfile valid, no re-resolution needed).

Testing

  • cargo build --locked
  • cargo test --workspace (12 passed)
  • cargo deny check advisories: RUSTSEC-2026-0382 reported on main, gone on this branch
  • prek hooks: fmt, clippy, biome, import-lint, sync-agent-config passed. ai-writing-check skipped: it fails identically on main (em dashes in crates/engine/src/gateway/*.rs, crates/cli/src/gateway_cmd.rs, CLAUDE.md; untouched here)
  • make ci: fails only on pre-existing audit (bun audit JS advisories, then cargo deny) and check_ai_writing, both unrelated to this lockfile change

Known pre-existing CI failures on main

  • Cargo Deny: RUSTSEC-2024-0449 (unsafe-libyaml via serde_yaml, unmaintained, no fix). Also rustls 0.23.36 is flagged by RUSTSEC-2026-0285 / 0346 / 0348 / 0349 (patched in 0.23.46). Out of scope here; worth a separate bump.
  • Clippy: if CI's Rust 1.99.1 reports double_must_use / needless_match, those are new lints already failing on main.

Related Issues

eMudhra CA incident follow-up.

Generated by Claude Code

Summary by cubic

Bumps rustls-webpki to 0.103.16 so TLS verification rejects certificate paths through the eight distrusted emSign (eMudhra) intermediate keys, whose private keys are now public (RUSTSEC-2026-0382). The previous bump of webpki-root-certs removed only the roots — the intermediate blocklist lives in rustls-webpki's path builder, so it needed its own bump.

Dependencies

  • Lockfile-only change: version and checksum of rustls-webpki (2 lines), pinned exactly so no other packages move — cargo update would also have moved several windows-sys dependents.