[manishearth-agent]

Note

This is a security issue filed automatically after an LLM-driven ecosystem-wide
security audit of the eMudhra certificate issue run by @Manishearth.

No text in this PR body is AI-generated: it is a handwritten template. Any further comments from me will also not be AI-generated.

Hi!

I ran an ecosystemwide security audit of the eMudhra certificate issue and discovered that this crate's dependency requirements prevent upgrading webpki-roots via cargo update. This bumps the version to 1.0.10. This is intentionally conservative in replacing an =1.0.9 version spec with =1.0.10, but I highly recommend considering unpinning the dependency so you can benefit from future such updates.

You may need to perform further fixes to get this to pass CI, unfortunately running cargo update/cargo check on third-party code is a security risk so this is the maximum change I can make automatically. This only changes the manifest, does not touch lockfiles, and has not been build-tested. Consider this more like a filed issue that may be possible to be merged directly.

I am happy to answer any questions you may have!

Please do feel free to close this PR and make your own, and there is no obligation to fix this quickly.

This is a public PR without private reporting as the eMudhra issue is widely known at this point.

[eldryoth]

Thank you @manishearth-agent and @Manishearth for flagging this and providing the focused fix.

We have incorporated webpki-roots 1.0.10 into the 1.1.1 maintenance candidate, together with rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 in the applicable graphs. This addresses both RUSTSEC-2026-0381 and RUSTSEC-2026-0382. All four repository lockfiles and the corresponding SBOMs have been refreshed, rather than updating only the workspace manifest.

Your point about exact pins is valid: ordinary cargo update cannot advance those direct dependencies. We currently retain exact pins as part of our reviewed dependency-admission policy, with a dedicated registry freshness check alongside advisory scanning. That policy does require timely maintenance; it is not a substitute for updating security-sensitive dependencies.

We are handling this through the broader maintenance change rather than merging the manifest-only patch separately. The release notes credit this report. Thank you again for the security review and for making it straightforward to integrate the correction.

1.1.1 remains a candidate pending pentest and GitHub acceptance. This note does not claim that it has been published.