Skip to content

chore(deps): bump rustls-webpki from 0.103.9 to 0.103.10#8

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/rustls-webpki-0.103.10
Closed

chore(deps): bump rustls-webpki from 0.103.9 to 0.103.10#8
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/rustls-webpki-0.103.10

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 21, 2026

Bumps rustls-webpki from 0.103.9 to 0.103.10.

Release notes

Sourced from rustls-webpki's releases.

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correct provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @​1seal for the report.

What's Changed

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

Commits
  • 348ce01 Prepare 0.103.10
  • dbde592 crl: fix authoritative_for() support for multiple URIs
  • 9c4838e avoid std::prelude imports
  • 009ef66 fix rust 1.94 ambiguous panic macro warnings
  • c41360d build(deps): bump taiki-e/cache-cargo-install-action from 2 to 3
  • e401d00 generate.py: reformat for black 2026.1.0
  • 06cedec Take semver-compatible deps
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [rustls-webpki](https://github.com/rustls/webpki) from 0.103.9 to 0.103.10.
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.9...v/0.103.10)

---
updated-dependencies:
- dependency-name: rustls-webpki
  dependency-version: 0.103.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Mar 21, 2026
tirthpatell added a commit that referenced this pull request Mar 21, 2026
Critical fixes:
- Fix /public_profile_posts → /profile_posts endpoint path (#1)
- Wire auto_publish_text param into build_text_params, skip
  publish call when auto-publishing (#2)
- Add is_carousel_item=true to create_media_container (#3)
- Allow coordinate-only location search (#4)
- Model link_total_values and follower demographics in Insight (#5, #6)

Major fixes:
- Add since/until to get_user_mentions and get_user_ghost_posts (#7, #8)
- Add type, application, data_access_expires_at to DebugTokenData (#9)
- Fix container polling to 5 attempts × 60s per docs (#10)
- Add create_image_reply and create_video_reply (#11)
- Make reply delay opt-in via apply_reply_delay parameter (#12)
- Add topic tag 1-50 character length validation (#13)
- Add is_eligible_for_geo_gating, recently_searched_keywords to
  USER_PROFILE_FIELDS (#14)
- Add fields parameter to lookup_public_profile (#15)
- Split REPLY_FIELDS vs PENDING_REPLY_FIELDS per endpoint (#16)
- Remove undocumented period param from post insights (#17)
- Remove undocumented search fields from PUBLISHING_LIMIT_FIELDS (#18)

Minor fixes:
- Remove phantom Post.reply_to field (#20)
- Skip container polling for text posts (#21)
- Return PostId from repost_post instead of extra API call (#22)
- Document millisecond timestamp unit on RecentSearch (#23)
- Change User serde alias to rename for correct serialization (#24)
- Make PublicUser.name optional (#25)
- Count emoji UTF-8 bytes in text length validation (#26)
- Validate before/after cursor mutual exclusivity (#27)

New features:
- Add hashtag_search convenience method (#28)
- Add get_my_posts/replies/mentions/ghost_posts shortcuts (#29)
- Add get_recently_searched_keywords convenience (#30)

BREAKING CHANGES:
- search_locations: query is now Option<&str>
- create_reply: added apply_reply_delay parameter
- repost_post: returns PostId instead of Post
- get_user_mentions/get_user_ghost_posts: use PostsOptions
- PublicUser.name: String → Option<String>
- User serde: alias → rename for profile_pic_url/biography
- PublishingLimits: removed search_quota_usage/search_config
@dependabot @github
Copy link
Copy Markdown
Author

dependabot bot commented on behalf of github Mar 21, 2026

Looks like rustls-webpki is up-to-date now, so this is no longer needed.

@dependabot dependabot bot closed this Mar 21, 2026
@dependabot dependabot bot deleted the dependabot/cargo/rustls-webpki-0.103.10 branch March 21, 2026 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants