Skip to content

build: bump rustls-webpki to 0.103.12 for RUSTSEC-2026-0098#5173

Closed
Copilot wants to merge 2 commits into
developfrom
copilot/fix-uri-name-constraints
Closed

build: bump rustls-webpki to 0.103.12 for RUSTSEC-2026-0098#5173
Copilot wants to merge 2 commits into
developfrom
copilot/fix-uri-name-constraints

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 17, 2026

What problem does this PR solve?

Problem Summary:

rustls-webpki 0.103.10 is affected by RUSTSEC-2026-0098 (GHSA-965h-392x-2mh5), where URI name constraints could be incorrectly accepted. This PR moves the resolved dependency to a patched release.

What is changed and how it works?

What's Changed:

  • Security dependency update
    • Updated Cargo.lock to resolve rustls-webpki from 0.103.10 to 0.103.12 (patched range).
  • Change scope
    • Lockfile-only change; no Rust source modifications.
[[package]]
name = "rustls-webpki"
-version = "0.103.10"
+version = "0.103.12"

Related changes

  • PR to update owner/repo: N/A
  • Need to cherry-pick to the release branch: as needed for maintained release branches

Check List

Tests

  • No code

Side effects

  • Breaking backward compatibility

Copilot AI changed the title [WIP] Fix incorrect acceptance of URI name constraints build: bump rustls-webpki to 0.103.12 for RUSTSEC-2026-0098 Apr 17, 2026
Copilot AI requested a review from eval-exec April 17, 2026 09:13
@eval-exec eval-exec closed this Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted

2 participants