Bump rustls-webpki and webpki-root-certs past the emSign advisories

Merged
JE
4d ago
+8-8

Context

Rust Tests is red on main: cargo deny reports RUSTSEC-2026-0382 (rustls-webpki 0.103.15) and RUSTSEC-2026-0383 (webpki-root-certs 1.0.9), both about distrusted emSign intermediates. They reach the crate only through reqwest (a dev dependency); the conformance runner's lock has the same two.

Change

cargo update -p rustls-webpki -p webpki-root-certs in rust/ and conformance/runner/rust/: 0.103.16 and 1.0.10. Nothing else moves.

Verification

make deny (both workspaces, advisories ok) and make rs-check rs-check-drift pass locally.

Alternatives

An ignore in deny.toml: rejected, patched releases exist. Waiting for Dependabot's cargo group (#253, #252): those don't include either crate.

Summary by cubic

Bumps rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10 in both Rust workspaces to resolve the emSign cert advisories (RUSTSEC-2026-0382, RUSTSEC-2026-0383) that were failing cargo deny on main.

  • Both crates only reach the codebase through reqwest, a dev dependency, and the conformance runner's lock file.
  • Only these two packages changed; nothing else moved in either lock file.
  • Verified with make deny on both workspaces and make rs-check rs-check-drift.