Distrust the compromised emSign intermediates: Go 1.26.10, rustls-webpki, webpki-root-certs and certifi

Merged
RO
12d ago
+11-11

Main's Security and Test workflows are red on the advisories published for the compromised emSign intermediate CA keys, and so is every PR branched from it (#1019, #1020). This clears all four.

  • Go: the go/go.mod toolchain moves from go1.26.9 to go1.26.10, which carries the crypto/x509 fix for GO-2026-6809. Every setup-go step reads its version from go/go.mod.
  • Rust: in rust/Cargo.lock, rustls-webpki 0.103.15 → 0.103.16 (RUSTSEC-2026-0382) and webpki-root-certs 1.0.9 → 1.0.10 (RUSTSEC-2026-0383). The conformance runner workspace depends on neither.
  • Python: certifi → 2026.10.19 in python/uv.lock and conformance/runner/python/uv.lock (GHSA-6q48-6c7w-9gw2). It's the same bump as Dependabot's #1020, but with the lockfiles kept at revision = 5; #1020 also rewrites them to revision 3. If this merges, #1020 can be closed.

Checked locally: govulncheck ./... on go1.26.10 finds nothing, cargo deny check advisories passes, and cargo check --locked builds. It follows #989.

Summary by cubic

Updates Go, Rust, and Python dependencies to distrust the compromised emSign intermediate CA keys, clearing the Security and Test CI failures caused by the published advisories.

  • Go: moves the go/go.mod toolchain to go1.26.10, which carries the crypto/x509 fix for GO-2026-6809; CI follows because setup-go reads its version from go/go.mod.
  • Rust: bumps rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10 in rust/Cargo.lock (RUSTSEC-2026-0382 and RUSTSEC-2026-0383); the conformance runner workspace depends on neither.
  • Python: bumps certifi to 2026.10.19 in python/uv.lock and conformance/runner/python/uv.lock (GHSA-6q48-6c7w-9gw2), keeping the uv lockfiles at revision 5.

Verified locally: govulncheck ./... on go1.26.10 finds nothing, cargo deny check advisories passes, and cargo check --locked builds.