[Nic-dorman]

Linear issue

Closes V2-1660

Part of V2-1659, which tracks the same move across every affected WithAutonomi lockfile.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Proposed rather than asserted. Lockfile only: 2 existing entries move within their semver range, each with the same dependency list as the version it replaces: rustls-webpki 0.103.15 → 0.103.16 (rust-version 1.71 on both sides), one patch release, and webpki-root-certs 1.0.7 → 1.0.10, three patch releases, whose rust-version rises from 1.64 to 1.71. That changes nothing in practice: ant-client declares no rust-version, and rustls-webpki already required 1.71. The one behaviour change is that TLS certificate paths through the distrusted emSign intermediates, or the removed emSign ECC Root CA - G3 root, no longer verify. No Autonomi protocol message changes. Same tier as the earlier rustls lockfile moves (ant-client#232, ant-node#256, ant-protocol#46, saorsa-core#177, saorsa-transport#190).

Compatibility

• Wire: none for the Autonomi protocol. For TLS, chains through the distrusted emSign intermediates now fail verification.
• Storage: none.
• API: none. No manifest or source file is touched; this is the lockfile only.

Semver impact

• breaking
• feature
• fix

Test evidence

Run on this branch: one commit on top of main at e47ea7a. RustSec database at 4b587f00 (2026-10-21), cargo-audit 0.22.1, cargo 1.97.1.

• cargo audit -f <lockfile>: on main's lockfile it reports RUSTSEC-2026-0382, RUSTSEC-2026-0383; on this branch none of them, and every other finding is unchanged.
• The diff is exactly the version and checksum lines of the moved entries: Cargo.lock 8 lines. No entry is added or removed.
• cargo metadata --locked accepts every changed lockfile. Each moved release has the same dependency list as the version it replaces, checked entry by entry.
• Not run locally: builds, Clippy and tests are left to this PR's CI. No production compat smoke was run, because nothing on an Autonomi protocol path changes.

New dependency

None. Two existing lockfile entries move within their semver range; none is added or removed.

ADR

n/a, Tier 1.

Mitigation / rollback

Revert the commit. It touches only lockfiles, so there is nothing to migrate either way.

---

What this is

Three RustSec advisories published on 2026-10-19 and 2026-10-20 cover one incident, CVE-2026-111943: the private keys of some emSign intermediate CAs are now well known, so certificate paths through them must stop verifying. This lockfile is affected by:

• RUSTSEC-2026-0382 (rustls-webpki, fixed in 0.103.16): rejects certificate paths that contain the distrusted emSign intermediate public keys.
• RUSTSEC-2026-0383 (webpki-root-certs, fixed in 1.0.10): drops the emSign ECC Root CA - G3 root.

Lockfile	Moves
Cargo.lock	rustls-webpki 0.103.15 → 0.103.16, webpki-root-certs 1.0.7 → 1.0.10

rustls-webpki is rustls's certificate-path verifier, compiled in through rustls, rustls-platform-verifier and rustls-post-quantum. webpki-root-certs is the bundled root store rustls-platform-verifier uses.

#233 (V2-1632) merged on 2026-10-23 and cleared the zip 2.4.2 advisories (RUSTSEC-2026-0367, -0368, -0369). This branch is rebased onto it (ad9eba5). With main's ignore list, cargo audit on the rebased lockfile now exits 0, with only the 8 allowed warnings, so this PR turns the Security Audit job green.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

REQUEST_CHANGES — CI gate only; I found no defect in the lockfile diff itself.

The exact head still has two failed macOS checks:

• Unit Tests (macos-latest): 867 passed, 1 failed. client_engine::adaptive::tests::fetch_hill_records_constant_size_timed_ops_without_stress failed at ant-core/src/data/client/adaptive.rs:3308; the assertion says timed successes left the controller at stress value 20.
• Merkle E2E (macos-latest): 6 passed, 1 failed. test_external_merkle_partial_payment_is_partial_upload failed while creating a P2P node (Failed to create dual-stack network nodes: Failed to create transport).

Please rerun both failed jobs on this head. If either reproduces, compare the same job on base ad9eba52c2e441b4f9c493f05db8c524b48bd8f0 and fix any regression before requesting approval. These failures are not attributed to the lockfile change; they are unresolved CI gates, not code findings. All other checks pass, including Security Audit. Local cargo metadata --locked, cargo audit (no vulnerabilities), and git diff --check pass. The two changed lockfile entries retain identical dependency lists.

Coverage: 2/2 seats reviewed this evidence (sol-1 gpt-6.1-sol xhigh: UNCERTAIN; glm-1 z-ai/glm-5.3: CHANGES_REQUIRED on the red CI gate). Their disagreement is about whether to issue a hold, not a confirmed source defect.

[MaidSafe-Hermes]

APPROVE — focused re-review of the previously unresolved CI gate, not a fresh full code review.

Reviewed head: d93e55014f2243447f462e9bc456257d3d0c5370 (unchanged from the prior review). The two macOS jobs that failed before now pass on GitHub Actions run 39942512923: Unit Tests macOS (868 passed, 0 failed in the main suite; all other groups pass) and Merkle E2E macOS (7 passed, 0 failed). All 18 reported PR checks are passing, including Security Audit.

The checks ran on GitHub's synthetic merge commit 7e24e15 (this PR head merged into base ad9eba5), not the raw head. The PR has no code delta; its lockfile-only change is unchanged. The prior CI-only blocker is resolved. The focused re-review found no remaining blocker from my side. Base advancement before merge may trigger a new required check run.

Coverage: 2/2 focused re-review seats reviewed the same evidence (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3). Both seats approve the resolved CI gate; this is not a fresh full code review. Approval is not a merge.